Your Word Documents Are Vulnerable: Here’s How Microsoft Copilot Puts Them at Risk
Security researchers have just exposed a serious flaw in Microsoft Copilot for Word—one that could silently alter your documents without your knowledge. If you use Word on a regular basis, you need to understand what’s happening and how to protect yourself.
The Vulnerability: How Hidden Text Can Hijack Copilot
Here’s how it works: An attacker can hide malicious instructions inside a Word document using white text on a white background—text so small you’d never notice it. When you open that document and use Copilot to summarize, edit, or generate content, Copilot reads everything in the file, including the hidden instructions.
Once Copilot processes those hidden commands, it follows them. In a proof-of-concept test, researchers demonstrated Copilot halving financial figures in a report and then copying the malicious prompt—in white, 8-point text—into the newly generated document. You won’t be notified that this happened.
This is particularly dangerous because the attack creates a propagation vector. The hidden instructions get embedded in the output file, which means if someone else opens that file and uses Copilot, the attack spreads again—like a worm passing from one document to the next.
Why This Matters to You
The attack requires no malware, no macros, and no special technical setup. It’s just text hidden in a document you might receive from anyone—a colleague, a vendor, a client, or an email attachment from a legitimate-looking sender.
The vulnerability stems from a fundamental architectural weakness: Copilot treats attacker-controlled content (the document text) and trusted instructions (Microsoft’s system prompts) as if they belong in the same context. Attackers exploit this by injecting prompts that override Copilot’s original directives.
Microsoft has attempted fixes. After researcher Håkon Måløy disclosed the technique on July 28, 2026—144 days after reporting it to Microsoft—the company blocked the original prompt wording and upgraded to GPT-5.5. However, Måløy confirmed the attack still works on GPT-5.6. This isn’t a closed issue; it’s a persistent architectural problem that patches alone won’t solve.
How to Protect Yourself
- Disable Copilot if you don’t need it. If you’re not actively using Copilot features, turnit off: Go to File > Options > Copilot and toggle it off. This eliminates the attack surface entirely.
- Treat external documents as untrusted. If someone sends you a Word file, assume itcould contain hidden instructions. Review the document in plain text first or ask the sender to confirm its contents.
- Review attachments before using them with Copilot. Before you ask Copilot tosummarize, edit, or analyze a file, open it in a basic text editor to check for suspicioushidden text. (In Word, use Find & Replace and search for white text formatting.)
- Verify Copilot-generated documents. After Copilot produces new content, spot-check it for accuracy. Look for unusual formatting, hidden text, or changes that don’t match your request.
The Bottom Line
This vulnerability highlights a real risk in AI-assisted tools—but it’s manageable if you stay alert. The key is treating documents you receive the same way you’d treat email links or downloads: with a healthy dose of skepticism. Verify, review, and think before you let Copilot process anything you’re unsure about.
For a deeper technical dive into how this attack works, see the original researcher’s full disclosure linked below.