A self-spreading prompt injection in Copilot
A researcher disclosed a document-borne worm in Copilot for Word: hidden white-on-white text that rewrites content and copies itself into every new document.
A security researcher published a coordinated disclosure on July 28 describing a self-propagating prompt injection attack against Microsoft Copilot for Word. The technique hides malicious instructions in a document using white text on a white background, invisible to a human reader but readable to Copilot once it strips formatting to read the file’s content. When a compromised document enters Copilot’s context during drafting, the hidden instructions trigger and quietly alter numbers or other content in whatever the AI generates next.
The self-propagating part is what makes this a worm rather than a one-off exploit: Copilot then copies the same hidden, concealed instruction set into the newly generated document, using the identical white-on-white technique. That document becomes a new carrier, capable of infecting the next Copilot session it’s fed into, and the one after that. The researcher notified Microsoft’s Security Response Center on March 6 and held the disclosure for 144 days across multiple extensions, publishing anyway once it became clear no complete fix was ready:
Defenders cannot reduce exposure to a risk they are unaware of.
Microsoft shipped several mitigations, including a model upgrade to GPT-5.5, but confirmed the underlying vulnerability class remains exploitable with modified payloads.
What it means for operators
This is a cross-domain prompt injection attack, a known category also behind fake bug reports that hijack coding agents like Claude Code and Cursor, but the self-propagation here is the part worth internalizing: a single compromised document doesn’t just corrupt one output, it can seed every future document that touches Copilot in the same organization. If your workflow involves reviewing contracts, reports, or any file that originated outside your team, that file is now a plausible attack vector even if it looks completely normal on screen. Until Microsoft closes the underlying vulnerability class rather than the specific payload demonstrated here, the practical defense is procedural: review any Copilot-generated document that traces back to an external file before it gets shared or redistributed further, and don’t assume a document is clean just because nothing looks visibly off. It’s the same lesson Hugging Face’s own agent breach taught at infrastructure scale: automated ingestion paths that look like ordinary data are, in practice, code-execution surfaces, whether the agent reading them is your vendor’s or your own.