Microsoft Copilot Can Secretly Plant Hidden Prompts in Your Word Docs

Michael Miller · 2026-07-30

Imagine drafting a report in Microsoft Word, hitting save, and unknowingly carrying a hidden set of instructions inside the file. That's exactly what security researcher Håkon Måløy discovered with Microsoft 365 Copilot. He found that hidden prompts can live inside a Word document, quietly influencing Copilot to rewrite figures and then copy those same instructions into the final file. It's a bit like a ghostwriter leaving notes for the next person—except you never see them. Måløy disclosed this technique on July 28, which was 144 days after he first reported the issue to Microsoft. That's a long stretch, especially when you think about how many businesses rely on Copilot for everyday tasks. The delay raises questions about how seriously these vulnerabilities are taken, and whether users are left exposed in the meantime. ### How the Attack Works The core of the issue is that Copilot doesn't just read the visible text in a document. It also processes hidden content, which can include instructions that aren't meant for human eyes. In Måløy's proof of concept, he embedded a prompt that told Copilot to change specific numbers in a report. When Copilot generated the new file, it followed those instructions and then embedded the same hidden prompt into the output. What makes this particularly sneaky is the persistence. The internally generated file didn't just execute the commands once—it triggered the same behavior again when used in a second Copilot drafting session. So, the hidden prompt travels with the document, creating a chain reaction. If you share that file with a colleague, they might unknowingly pass it along too. ### Why This Matters for Professionals If you're using Copilot to draft financial reports, sales projections, or any document with numbers, this is a serious concern. A hidden prompt could alter figures without you noticing, and the changes might look completely legitimate. It's not just about data integrity; it's about trust. You need to know that what Copilot produces is based on what you actually wrote, not on some invisible script. Here's what you should keep in mind: - Hidden prompts can be embedded in Word documents without your knowledge. - Copilot may follow these instructions and then propagate them to new files. - The effect persists across multiple drafting sessions, making it hard to track. - Sharing such files could spread the hidden instructions to others. ### What You Can Do Right Now While Microsoft works on a fix, there are steps you can take to protect yourself. First, be cautious about opening documents from untrusted sources. If you receive a file that seems off, don't let Copilot process it. Second, consider reviewing the raw XML of a Word document if you're tech-savvy—hidden prompts often live in the underlying code. Third, always double-check any figures that Copilot generates, especially if the source document came from someone else. It's also worth staying updated on Microsoft's security patches. The company acknowledged the report, but a 144-day gap between disclosure and public knowledge is a reminder that vulnerabilities can linger. Until a fix is rolled out, treat Copilot's output with a healthy dose of skepticism. ### The Bigger Picture This isn't just about one bug. It's about how AI tools handle hidden data. As more professionals rely on AI to draft, edit, and analyze documents, the risk of hidden instructions grows. Måløy's discovery is a wake-up call for anyone using AI-assisted writing tools. The convenience is real, but so are the risks. For now, the best defense is awareness. Know what your tools are doing, question unusual outputs, and don't assume that everything Copilot produces is safe. If you're managing a team, make sure everyone understands the potential for hidden prompts and how to spot them. It might feel paranoid, but in a world where AI can be manipulated, a little caution goes a long way. As the story develops, keep an eye on Microsoft's response. A fix might be on the way, but until then, your vigilance is the best protection.