A security researcher has demonstrated a worm-like prompt injection attack against Microsoft Copilot for Word. The attack begins inside an ordinary document, but its real target is the way Copilot reads, reuses, and transfers instructions from one file into another.
The finding matters because the malicious content is not meant for the human reader. It is hidden from view, while remaining accessible to Copilot. Once Copilot processes the document, the hidden instructions can move into a new file and make that file a carrier too.
How the hidden Word doc attack works
Håkon Måløy describes the attack as a worm-like chain built around prompt injection. The attacker places instructions in a document using white text on a white background at a tiny font size. A reader looking at the page does not see those instructions.
Copilot can still process them. According to the source, Copilot strips color and font size before processing the document. That means the visual tricks that hide the text from people do not hide it from the AI system.
The document then becomes more than a static file. When someone uses it as a source, Copilot runs the hidden instructions and copies them into the new file. That new file can carry the same hidden behavior forward.
The key sequence is simple:
- An attacker hides instructions in a Word document.
- The text is invisible to readers because it uses white text on a white background and a tiny font size.
- Copilot reads the hidden instructions when processing the document.
- Copilot copies the instructions into a new file.
- The new file becomes another carrier if it is used as a template or source.
Why this becomes self-spreading
The risk comes from reuse. A single compromised document can influence a later document if Copilot uses it as source material. If that later file is reused again, the same pattern can repeat.
The source gives a practical example: a compromised market analysis from the internet could manipulate a financial report. That financial report could then infect further reports. The important point is not just that one file is affected, but that the hidden instructions can travel through normal document workflows.
This makes the attack different from a one-time prompt injection. In a one-time case, hidden instructions may affect a single AI interaction. In Måløy’s described scenario, the instructions are copied onward, so the output can become part of the next input.
That chain is what gives the attack its worm-like character. The document is not only a target. It becomes the mechanism that helps the attack continue.
Microsoft confirmed the behavior
Microsoft confirmed the behavior on March 31. The source says two fix attempts failed. After 144 days, Måløy published his findings with no fix in place.
Måløy is holding back the payload text. That detail matters because it means the public report describes the attack pattern without publishing the full hidden instruction content used to trigger it.
The timeline in the source is limited but clear. Microsoft was aware of the behavior, attempts were made to address it, and the findings were eventually published while the issue remained unresolved.
What this shows about prompt injection
The case highlights why prompt injections remain an unsolved AI security problem. Copilot is being asked to interpret documents, but some document content may be written for the AI rather than for the person using the file.
In this example, the attack depends on a gap between human visibility and machine processing. A person may see an ordinary document. Copilot may see additional instructions that were deliberately hidden through formatting.
That creates a practical challenge for AI tools in document workflows. If hidden instructions can be treated as commands, and if those commands can be copied into new files, then trust in a document cannot be based only on what is visible on the page.
The source also notes that AI researcher Andreas Kirsch recently joked he wished someone would build exactly this worm to convince skeptics that AI security risks are real. Now it exists.
The broader lesson for AI-assisted documents
The attack described by Måløy is narrow in its facts but broad in its implications. It shows that an AI assistant working inside office documents may process content differently from a human reader. That difference can be exploited when hidden instructions are preserved, interpreted, and reproduced.
For teams using Microsoft Copilot for Word, the source points to a clear concern: documents from external sources can carry instructions that are not visible during ordinary review. If those documents become inputs for new work, the hidden prompt injection can move with the generated content.
The central issue is not whether a user intentionally runs malicious code. The source describes a document-based prompt injection that works through Copilot’s handling of text. The attack lives inside the workflow of reading, summarizing, drafting, and reusing Word files.
That is why the finding is significant. A Word document can appear harmless to the reader while still containing instructions aimed at Copilot. Once those instructions are copied into another file, the risk can continue beyond the original document.