As reported by The Hacker News, security researcher Håkon Måløy has publicly disclosed a prompt injection vulnerability in Microsoft 365 Copilot for Word that allows hidden instructions embedded in a document to manipulate AI-generated content — and then silently propagate those same instructions into newly created files. The disclosure came 144 days after responsible reporting to Microsoft, with no public patch confirmed at time of release.
Why This Is a Watershed Moment for AI-Assisted Document Security
This isn't simply another prompt injection curiosity. What Måløy has demonstrated is a self-replicating AI attack chain — a behavior that security researchers have theorized about since generative AI tools entered the enterprise, but which now has a concrete, reproducible proof of concept against a widely deployed commercial product.
The implications extend far beyond a single manipulated report. Consider the attack surface: Microsoft 365 Copilot is deployed across millions of enterprise users who routinely trust AI-assisted drafting to summarize, rewrite, and generate documents from existing source material. If a malicious or compromised document can silently instruct Copilot to alter financial figures, redact risk language, or insert false data — and then embed those same instructions into the output — the infection potential scales with every downstream document generation event.
"The most dangerous aspect of this technique is not the first-generation manipulation — it's the second. A document that corrupts its own offspring is, by definition, a worm."
Who Is at Risk
Organizations most exposed to this technique include those that:
The threat is amplified in environments where documents flow between organizations — think supply chain document sharing, legal discovery, or M&A due diligence workflows. A single poisoned source document entering a Copilot-assisted review pipeline could cascade silently through multiple generated artifacts.
The Broader Prompt Injection Problem Is Not Being Solved Fast Enough
This disclosure is part of a troubling pattern. Prompt injection — the AI equivalent of SQL injection — has been a known and documented attack class since large language models entered production environments. Yet vendors continue to ship agentic AI features that consume untrusted content without adequate sandboxing or instruction provenance controls. The 144-day disclosure timeline without a shipped fix reflects an industry-wide gap between AI feature velocity and AI security maturity.
Microsoft is not alone in this. Similar injection techniques have been demonstrated against Google Workspace AI features, Claude, and various RAG-based enterprise tools. The consistent failure mode is the same: models are not architecturally capable of distinguishing between trusted system instructions and adversarial content in user-supplied data. Until that changes at a model or runtime level, every AI feature that reads external documents is a potential injection surface.
Shield53 Recommendations
Immediate Actions
- Audit Copilot usage policies: Identify which workflows involve Copilot processing externally supplied or customer-provided documents. Restrict or suspend AI-assisted drafting from untrusted sources until Microsoft issues guidance.
- Implement human review checkpoints: Any Copilot-generated document containing figures, risk assessments, or contractual language should require explicit human verification before distribution or further AI processing.
- Do not chain AI sessions without review: Avoid using Copilot-generated documents as the direct input for subsequent Copilot drafting sessions. Break the chain with human-reviewed intermediary steps.
- Enable Microsoft Purview audit logging: Ensure Copilot interaction logs are captured and retained so anomalous generation patterns can be investigated post-incident.
- Train document owners: Educate staff that hidden text, white-on-white text, and metadata fields in Word documents can carry adversarial instructions invisible to the human eye but readable by AI systems.
Longer-Term Controls
- Engage your Microsoft account team to understand when a formal patch or architectural mitigation will be available, and request inclusion in any preview programs for Copilot security updates.
- Evaluate DLP policies to flag documents where Copilot-generated content deviates significantly from source material — statistical drift detection can serve as an early warning signal.
- Incorporate AI prompt injection scenarios into your threat modeling exercises for any workflow involving LLM processing of external data.
The era of AI-powered document workflows demands a commensurate evolution in document trust models. Organizations that treat Copilot output as inherently authoritative — without understanding the instruction surface that feeds it — are accepting risks that their security teams have not yet been asked to assess.
