Researcher Discloses Self-Propagating Copilot for Word Prompt-Injection Chain
Security researcher Håkon Måløy disclosed on July 28 that hidden instructions in a Word document can influence Copilot-generated output and copy themselves into new documents. Måløy says the broader prompt-injection class remained reproducible after 144 days of coordination and two mitigation attempts; Microsoft told The Register that it had addressed the reported findings and continues to strengthen layered safeguards.
Security researcher Håkon Måløy published a coordinated disclosure on July 28 describing a document-borne prompt-injection chain in Copilot for Word. In his proof of concept, hidden instructions in a source document altered a Copilot-assisted draft and were then copied into the new document, allowing that file to become another carrier when reused in a later Copilot workflow.
The finding is a demonstrated proof of concept, not evidence of a widespread compromise. Måløy withheld the exact payload and disclosed the vulnerability class after a 144-day coordination period with Microsoft Security Response Center and Microsoft product teams.
How the propagation works
Måløy's scenario starts with an attacker-controlled Word document containing instructions concealed with small white text. When that document enters Copilot's context, the model can treat the embedded text as instructions rather than untrusted source material.
In the demonstration, Copilot changed figures in a financial report and appended the hidden prompt to the generated document. If a colleague later used that internally created report as source material, the instructions could trigger again without the original malicious file being present.
That makes the reported path different from a classic Office macro worm. The technique does not rely on executable macro code; it exploits the boundary between a user's request and untrusted document content processed in the same model context.
Disclosure and mitigation status
Måløy's timeline says he first reported the issue to Microsoft on March 6. Microsoft confirmed the behavior on March 31, and two mitigation efforts followed. He reported that the original wording was blocked, but modified prompts reproduced the behavior after later model updates, including testing on July 28.
The Register published Microsoft's response on July 29. Microsoft said it had addressed the researcher's findings, uses defense-in-depth safeguards to block malicious instructions and keep tasks aligned with user requests, and continues to strengthen those protections. The company also advised customers to install updates, treat unknown content cautiously, and review AI-generated material before use or sharing.
For teams using assistants over enterprise documents, the practical issue is document integrity. External and partner files should be treated as untrusted inputs, and high-stakes Copilot-generated documents need review before they are reused as source material. Those controls may reduce exposure, but Måløy wrote that no customer-side measure fully addressed the broader class at publication.
Key Points
- 1Måløy demonstrated that hidden instructions in a source document could alter Copilot output and be copied into a new Word document that becomes another carrier.
- 2The July 28 disclosure says the broader class remained reproducible after 144 days and two mitigation attempts, although Microsoft said it had addressed the reported findings.
- 3The report describes a proof of concept rather than a known widespread compromise; document review and untrusted-input controls remain the immediate operational safeguards.
Scoring Rationale
The disclosure concerns a potentially self-propagating prompt-injection path in a mainstream enterprise productivity assistant, with implications for document integrity and AI-assisted knowledge workflows. It is a reported proof of concept rather than a confirmed widespread compromise, but the researcher's claim that the broader class remained reproducible makes it notable for security and ML platform teams.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
