A significant security disclosure has highlighted a unique persistence mechanism within Microsoft 365 Copilot for Word that allows hidden instructions to survive the document drafting process. According to The Hacker News, researcher Håkon Måløy demonstrated that hidden text within a source document can trick the AI into not only altering its output but also embedding those same instructions into the newly generated file. This disclosure comes 144 days after the initial report to Microsoft, signaling a complex challenge in securing generative AI integrations within enterprise productivity suites.
The Mechanics of Microsoft 365 Copilot Prompt Injection
The vulnerability relies on a technique known as indirect prompt injection. In a typical scenario, an attacker places hidden instructions—often using white text on a white background or extremely small font sizes—within a legitimate-looking Word document. When a user leverages Copilot to summarize this document or draft a new report based on its contents, the AI processes the hidden text as part of its instructions.
The technical novelty here is the persistence of the malicious prompt. Måløy discovered that the AI could be instructed to “copy its own instructions” into the output. This results in a new document that contains the same hidden Phishing lures or malicious directives as the original. If this secondary document is later used by another user or another automated process, the cycle continues. This creates a risk of AI prompt persistence across documents, effectively allowing a malicious instruction to move through an organization’s file system without manual intervention by the threat actor.
Detecting Indirect Prompt Injection in Word
Identifying these attacks requires a shift in how the SOC monitors document-based threats. Traditional antivirus solutions often scan for macros or known malware signatures, but they are not currently designed to parse the semantic intent of hidden text within a Large Language Model (LLM) context. Detecting such activity requires analyzing the TTP of the AI interaction itself. If a document triggers a rewrite that includes suspicious instructions or attempts to hide metadata, it may indicate a successful injection.
Security teams should consider integrating AI-specific logging into their SIEM to monitor for anomalous output patterns. For example, if multiple documents generated by Copilot suddenly contain identical hidden strings or consistent stylistic deviations, it may indicate that a base template has been poisoned. This vulnerability highlights the necessity of a Zero Trust approach to AI-generated content, where no output is considered safe simply because it originated from an internal tool.
Mitigation and Strategic Recommendations
Defenders must prioritize the sanitization of source material. Because Microsoft 365 Copilot prompt injection relies on the AI’s ability to read “invisible” text, organizations should implement automated workflows to strip hidden formatting or metadata from documents before they are used as inputs for AI drafting.
Furthermore, user education is vital. Employees must understand that AI is a collaborative tool that can be influenced by the data it reads. If a user receives a document from an external source and uses Copilot to process it, they are potentially introducing untrusted instructions into their local environment. Organizations should establish clear policies regarding the types of data that can be used as context for AI tools and ensure that high-value reports are manually reviewed for hidden content before finalization. As AI integrations become more deeply embedded in the enterprise, the ability to recognize and neutralize these subtle injection vectors will become a foundational component of modern security posture.