Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished file. Håkon Måløy disclosed the technique on July 28, 144 days after reporting it to Microsoft. In his proof of concept, the internally generated file
Imagine this: you're working on a critical report in Microsoft Word, and you ask Copilot to help you polish the numbers. You trust it to do the job. But what if, behind the scenes, the AI was following secret instructions buried in the document—instructions that could change your data without you ever knowing?
That's not a hypothetical scenario. A security researcher named Håkon Måløy just proved it's possible. On July 28, he went public with a technique that lets hidden prompts inside a Word file hijack Microsoft 365 Copilot's behavior. The kicker? He first reported the issue to Microsoft 144 days earlier, and the company still hadn't fixed it.
### How the Attack Actually Works
Måløy's proof of concept is both clever and a little unsettling. He embedded a set of hidden instructions directly into a Word document. When Copilot opened that file and began a drafting session, it didn't just read the visible text—it also absorbed those covert commands.
Here's the scary part: those instructions told Copilot to rewrite the figures in the report. Not just tweak the wording, but actually change the numbers. And once Copilot finished the task, it copied the same hidden instructions into the newly generated file. That means the poison spreads.
In his demonstration, Måløy took the internally generated file and fed it into a second Copilot session. The behavior repeated perfectly. The AI once again followed the hidden commands, altering data and embedding the malicious instructions into yet another fresh document.
### Why This Matters for Your Workflow
You might be thinking, "Okay, but who's going to plant hidden prompts in my files?" It's a fair question. But think about how often you open documents from outside sources—email attachments, shared drives, client submissions, or even files you download from the web.
If someone with ill intent gets a document onto your system, they could potentially:
- Change financial figures in a quarterly report
- Alter product specifications in a technical document
- Insert false statements into a legal brief
- Modify customer data in a sales proposal
And here's the real kicker: because Copilot is copying those instructions into every new file it creates, the attack can propagate. One infected document becomes two. Two become four. Before you know it, your whole project folder is compromised.
### The 144-Day Problem
Måløy didn't just stumble onto this by accident. He found the flaw, documented it carefully, and reported it to Microsoft on March 6. That's when the clock started ticking. The company had 144 days to respond, patch the issue, or at least acknowledge the severity.
Nothing happened. No fix, no workaround, no public advisory. So on July 28, he went public with his findings. That's not an unreasonable move—many security researchers follow a 90-day disclosure window, and Måløy gave Microsoft nearly five months.
### What This Means for Copilot Users
If you rely on Microsoft 365 Copilot for drafting, analysis, or data processing, this should be a wake-up call. AI tools are powerful, but they're also blind to the trustworthiness of the content they process. A hidden instruction is just as real to Copilot as a visible one.
So what can you do right now? Start by being cautious about the documents you feed into Copilot. If a file comes from an untrusted source, treat it like you would a suspicious email attachment. Don't let the AI process it without a thorough review first.
Also, keep an eye on Microsoft's security updates. This disclosure is fresh, and the company will likely need to address it eventually. But until a patch lands, you're the first line of defense.
### The Bigger Picture
This isn't just about one vulnerability in one product. It's a reminder that AI tools inherit the flaws of the content they process. We're entering an era where the data we feed into these systems matters more than ever—not just for quality, but for security.
For now, the safest approach is simple: trust your AI, but verify everything it produces. And definitely don't let it run wild on files you didn't create yourself. The hidden prompts are out there, and they're looking for a way in.
