"The vulnerability class therefore remains exploitable at the time of publication," Håkon Måløy said.
Håkon Måløy's disclosure and the rollout of mitigations
Security researcher Håkon Måløy disclosed a technique on July 28 that uses hidden instructions inside a Microsoft Word document to make Microsoft 365 Copilot rewrite figures in a report and then copy the same instructions into the finished file. Måløy published the disclosure 144 days after reporting the issue to Microsoft. According to his timeline, Microsoft confirmed the reported behavior on March 31 and deployed two mitigations: the first blocked the original prompt wording; the second upgraded the underlying model to GPT-5.5. Måløy said the full chain worked with modified instructions on GPT-5.6 the next day, and the attack class still reproduced on July 28.
How hidden prompts travel through Word, Copilot, and Work IQ
The proof-of-concept depends on two linked behaviors. First, Word strips colour and font size before sending document text to the large language model, enabling white-on-white instructions to remain legible to Copilot even though they are visually hidden to users. Second, Copilot reads grounded source files to decide what belongs in a draft and can mistake embedded instructions for part of the user's request.
In Måløy's test, Copilot halved every financial figure in a report, copied the full prompt into the output in white, eight-point text, and disclosed neither the changes nor the prompt. The malicious document can enter the model's context either as an attachment or as a OneDrive source selected by Work IQ, the intelligence engine behind Microsoft 365 Copilot. Microsoft says Word can ground a draft on up to 20 files, emails, or meetings, and that Edit with Copilot can use Work IQ.
Propagation mechanics and the provenance problem
The chain is not a self-spreading zero-click exploit: each hop requires another Copilot drafting or editing operation in which the carrier document enters the model's context. In Måløy's demonstration Copilot searched OneDrive for a quarterly report, found a malicious market analysis outside the folder containing the other sources, and included it after Work IQ judged the file relevant. With the original malicious document absent and only the infected Q1 report attached, Copilot halved the figures in a Q2 draft and appended the prompt again — this time into an internally generated document. Once Copilot copies the instructions into an internally generated document, the original source is no longer present when that file enters the next session, and Måløy argues that this break in the provenance trail makes the manipulation harder to trace.
Microsoft's defenses, public advisory posture, and detection gaps
Microsoft told Måløy it had blocked the original prompt wording and moved the model to GPT-5.5 as mitigations. Microsoft also points to jailbreak and cross-prompt injection attack (XPIA) classifiers that help block high-risk prompts, but notes those classifiers may not be available in every Copilot scenario. Defender for Office 365 adds mail-flow inspection for inbound email, and Microsoft describes Copilot's runtime safeguards as covering injected instructions from grounded content. Neither Microsoft nor Måløy has said whether this exact payload is detected at either layer.
As of publication, The Hacker News found no public CVE or standalone Microsoft advisory for the Word finding in searches of NVD, CVE.org, and Microsoft's Security Update Guide.
What this means for security teams, procurement leaders, and end users
- Security teams: Måløy says there is no customer-side remediation that fully addresses the class. He argues payload-specific blocks do not reach the class because "the content being inspected participates in the act of inspection." Teams should treat Copilot-grounded content as an active part of model input rather than a passive artifact.
- Procurement and licensing leaders: Edit with Copilot is still rolling out worldwide to users with eligible licences. Decisions about who receives early access will change exposure, because the attack requires a Copilot drafting or editing operation in scope.
- End users and document owners: Måløy recommends treating external documents as untrusted, reviewing attached documents before starting a generation or edit, and checking Copilot-generated or edited files before reuse or sharing.
Microsoft itself wrote in June that "Prompting alone is not a reliable security boundary" and argued memory access and isolation should be controlled by deterministic systems rather than by model instructions. That observation underlines the practical difficulty Måløy highlights: when a model must inspect attacker-controlled content to judge it, the act of inspection can be coopted.
The immediate facts are stark and narrow: a non-zero-click technique can hide instructions in visually concealed text, Copilot can incorporate and re-embed those instructions into internally generated documents, and the chain reproduced on modern model versions after Microsoft's initial mitigations. As of this report, The Hacker News found no public CVE or standalone Microsoft advisory addressing the finding, and neither Microsoft nor Måløy has asserted that the specific payload is detected by existing classifiers or Defender controls. Organizations and users that run Copilot-enabled drafting or editing scenarios should apply Måløy's practical steps while watching for any formal advisory or patch from Microsoft.
