The Norwegian security researcher Håkon Måløy has disclosed a vulnerability in Microsoft 365 Copilot for Word that spreads like a computer worm. Hidden text in a document causes Copilot to alter content and copy the malicious instruction into newly created files. Microsoft has been aware of the issue for 144 days and has not yet fully resolved it.
White text lets Copilot secretly alter content
Måløy calls the technique Cross-Domain Prompt Injection: attackers hide instructions as white text on a white background in a Word file. If someone opens the document with Copilot, for example to turn it into a report, the AI reads the invisible text as part of the task rather than as foreign content. In a demonstration, Copilot quietly changed financial figures in a report and copied the hidden instruction into the newly generated file.
That new file becomes the next carrier: as soon as someone else uses it in another Copilot operation, the instruction activates again and moves into the next document. An attacker only needs to put a single prepared file into circulation, for example as an email attachment or in a shared folder.
Out of responsibility toward affected organizations, Måløy did not publish the exact wording of the malicious instruction or a working attack script. He argues that no robust defense exists yet for the entire vulnerability class, and that a complete recipe would needlessly raise the risk.
Two mitigation attempts fail in 144 days
Måløy reported the bug to the Microsoft Security Response Center on March 6, 2026, which confirmed the vulnerability by the end of March. An initial update in early April closed only the original proof-of-concept instruction but could be triggered again with reworded prompts. Microsoft asked for extra time in June and pushed the disclosure date originally set for June 8 back to July 15. A model upgrade to GPT-5.5 changed nothing either, according to Måløy: two weeks before the eventual July 28 disclosure, the attack still worked in his own tests against GPT-5.6.
Microsoft told CSO Online that it had addressed the reported findings and relies on a defense-in-depth strategy meant to block malicious instructions at multiple points. The company does not name a complete technical fix for the underlying vulnerability class. Måløy considers the problem architectural, embedded in practically all prompt-based AI systems – despite the AI-powered vulnerability scanning that Microsoft had only expanded to Windows in July.
Companies with Copilot workflows carry the risk
In principle, any organization that uses Copilot in Word for reports, contracts, or internal policies is exposed – the attack chain needs only a single infiltrated document. So far, according to consistent reporting across several security outlets, the attack remains a pure proof of concept; no real-world incident has been confirmed. Microsoft advises installing current updates, combining multiple layers of protection, treating documents of unknown origin with caution, and reviewing Copilot-generated content before sharing it.
This is already the third installment of his “Context Collapse” series: in the first part, Måløy demonstrated memory manipulation in Copilot, and in the second, filed under CVE-2026-55145, prompt injection via email text in Outlook Copilot, for which Microsoft has since found more effective safeguards. That has not happened yet with the current Word variant. The series points to a recurring pattern: in its current versions, Copilot barely distinguishes between trusted user instructions and text originating from foreign files or messages.
What remains open is whether Cross-Domain Prompt Injection can be technically prevented at all as long as assistants like Copilot read every piece of text in a document as an equally possible command. Until a structural fix exists, the responsibility effectively shifts to companies that have to secure their own document workflows.
