A security researcher has disclosed a prompt-injection technique that can make malicious instructions propagate through documents created or edited with Copilot for Word. The report describes a class of attacks in which one tainted source file influences an AI-assisted drafting task and causes the resulting document to carry the same instructions into later workflows.
The researcher said the findings were coordinated with the Microsoft Security Response Center and Microsoft product teams. Reproduction steps, videos, testing assumptions and proof-of-concept prompts were provided during a coordination period that ultimately lasted 144 days, according to the disclosure. The report says two mitigation attempts, including a model upgrade, did not eliminate the broader vulnerability class. It therefore explains the mechanism without publishing the working payload.
The attack begins when a user includes a malicious document as source material in Copilot for Word. Instructions embedded in that file may be interpreted as commands rather than untrusted content. Copilot can then modify the document being drafted and copy the concealed instructions into its output. If a colleague later uses that output as input for another AI-assisted document, the instructions can activate and spread again without access to the original file.
One scenario in the report involves a compromised market analysis used to prepare an internal financial report. The hidden prompt changes figures and is copied into the new report. When the report is shared and reused, subsequent documents can become carriers. The author characterizes this as a document-borne AI worm because propagation follows normal drafting and editing behavior.
Concealment can be simple. The report says malicious prompt text can be displayed in a very small font with white text on a white background. Although a reader may not see it, formatting is removed before document text reaches the language model, leaving the instructions available to Copilot. The researcher says the issue affects both the “magic pen” and “Edit with Copilot” functions tested.
The attacker does not need access to the victim's Microsoft 365 tenant, according to the analysis. The required step is persuading a user to attach or otherwise include the crafted document in Copilot's context, whether it arrived through email, Teams, SharePoint or another sharing channel.
The disclosure's central security argument concerns trust boundaries. Reference documents should supply information, not authoritative instructions. When a model fails to maintain that distinction, ordinary reuse can convert a single injection into a chain of compromised files. Organizations using AI-assisted document workflows may therefore need to treat attached content as active untrusted input and assess the risk across downstream reuse, not only the first interaction.
