Hidden instructions in the document: a file you didn't write is untrusted input

Overview

On 28 July 2026, researcher Håkon Måløy published screenshots of Copilot in Word halving the financial figures in a quarterly report — and then writing the attacker’s instructions into the new document it produced, in white text, without mentioning that it had done either.

Why now. Every prompt-injection story until this one needed something exotic: an agent, a browser, a terminal, a connector nobody has been given. This one needs a Word file. Måløy reported it to Microsoft on 6 March 2026; Microsoft confirmed the behaviour on 31 March and shipped two mitigations, the second an upgrade of the underlying model to GPT-5.5 on 14 July. He reproduced the attack against GPT-5.6 the next day and published at 144 days.

What you’ll take away: the one sentence that explains how this works, and a handling habit for documents that arrive from outside.

The content

Here is the whole mechanism, and it is worth reading twice. Copilot for Word strips formatting — colour, font size — before the document text reaches the model. In the researcher’s words, hidden text “remains fully readable to Copilot even though the victim cannot see it.” White text on a white page, size 8 in the demonstrated payload, is invisible to you and perfectly legible to your assistant. Every other detail follows from that asymmetry.

The new part is what Måløy calls the self-propagation stage. Copilot didn’t just obey the hidden text — it appended that text into the document it drafted for him, concealed the same way. So the carrier stops being a stranger’s file and becomes your colleague’s.

Now the part to resist the comfortable reading of. It would be reassuring if the spread required someone to deliberately attach the poisoned file, because then the chain would have an obvious place to break. It doesn’t. In one demonstration the victim only asked Copilot to write a quarterly financial report; Copilot searched their OneDrive, found the affected document itself, and the instructions ran again. The primary is flat about it: “Copilot does not require the victim to attach the malicious document though.” Which means the honest caveats are elsewhere. Two are the researcher’s own: this is a two-hop proof of concept, and the payload was deliberately withheld. Two are just the state of things as this publishes — no independent reproduction, and no reported exploitation in the wild.

So where do you actually stand in this? Two places, and neither is the attachment step. You choose what gets parked in the store your assistant is allowed to search, and you choose what leaves your hands afterwards. The document spreads by being useful.

Which brings up a gap worth knowing about. Microsoft’s guidance for the people building these systems says to “assume indirect prompt injection will happen” and to “design systems with the expectation that some attacks will succeed” — because, as the same page puts it, the AI is unable “to distinguish between user input and external content, making traditional input validation insufficient.” Now compare what the person typing is told. Microsoft’s transparency card for 365 Copilot, updated 9 July 2026, does ask you to review responses and warns about overreliance, and it does list “indirect jailbreak” among the risks it evaluates. But its limitations section runs to compatibility, connectivity, supported languages and unsuitable domains — and where it does turn to the output itself, the worry is that the AI is wrong: ungrounded content, bias, mistakes. Checking whether an answer is accurate and checking whether a document has been giving your assistant instructions are not the same habit, and only one of them is being asked of you.

This is not a Microsoft problem. In August 2025, Zenity Labs hid a prompt in a document using “1px white font” and used it to attack ChatGPT’s Connectors — same concealment, different vendor, a year earlier. Nothing in the technique is specific to Word, so the safe default is to assume the exposure exists anywhere an assistant reads a file you didn’t write: Glean, Sana, enterprise ChatGPT uploads. Treat that as the prudent inference it is — Zenity’s is the only cross-vendor demonstration on the record.

Try it

Take a document that actually arrived from outside your organisation this week — a vendor proposal, a market analysis, a draft contract — and run this before you point your assistant at it. Work on a copy, because step one edits the file.

1. REVEAL WHAT I CAN'T SEE
   Ctrl+A, set font colour to Automatic, set size to 11.
   Hidden white or very small text becomes visible.
   (Automatic resolves to white on a dark or shaded background,
   so it is not a universal reveal.)
   Also: File > Options > Display > tick "Hidden text" — Word has a
   Hidden attribute that a colour change alone won't expose.

2. STRIP THE HIDING PLACE
   If I only need the words, paste into a plain-text editor and back,
   or paste with "Keep Text Only". The concealment lives in the
   formatting, so removing the formatting removes it.

3. DON'T PARK IT WHERE COPILOT LOOKS
   An unvetted external file sitting in OneDrive or SharePoint can be
   retrieved without me ever attaching it. Vet it, or keep it out.

4. READ WHAT CAME OUT, NOT JUST THE ANSWER
   Before I forward or build on anything my assistant generated:
   is there text in here I didn't ask for?

Where this breaks — and it does. Steps one and two defeat this concealment, not the category: instructions can be worded to read as ordinary prose, tucked into footnotes or comments, or hidden in ways a visual sweep won’t catch. Two Microsoft mitigations did land, and after each, the old payloads stopped working; the claim that reworded versions still work against newer models is the researcher’s alone, and unverifiable while the payload stays private. No CVE appears to have been assigned for this specific finding — while a separate Outlook Copilot bug from the same researcher, in the same disclosure round, was indexed as CVE-2026-55145. And the demonstration is Copilot for Word — the “magic pen” and “Edit with Copilot”, with OneDrive as the store it retrieved from. Treat other surfaces as untested rather than cleared.

Step four is the one that keeps paying, and it is also, word for word, what Microsoft asks of customers: “treat content from unknown sources with caution, and review AI-generated content before using or sharing it.” It holds up because it doesn’t require you to out-spot a hiding technique. It only requires you to read what your assistant wrote before you hand it to someone else.

Additional reading

• Context Collapse Part 3 — AI Worming through Word (Håkon Måløy) — the primary research, with screenshots. Copilot strips “color and font size before passing the text into the underlying Large Language Model”; Figure 4 shows it appending the attack prompt into a generated document in white size-8 text after halving the financial numbers; Figure 5 is the one to read — “Copilot does not require the victim to attach the malicious document though” — and Figure 7 shows the second hop with the original attacker document absent. Full disclosure timeline, and the decision to “disclose at the class level rather than the payload level.”
• Word worm crawls into Copilot, spreads chaos (The Register) — Microsoft on the record: it has “addressed the findings reported by the researcher”, uses “a defense-in-depth strategy with safeguards that block malicious instructions at multiple points”, and encourages customers to “treat content from unknown sources with caution, and review AI-generated content before using or sharing it.” Note that its own account of the spread is narrower than the primary’s, describing another employee adding the report to their work.
• Defend against indirect prompt injection attacks (Microsoft Learn) — Microsoft’s architect-facing pattern (last content update 26 March 2026): “Assume indirect prompt injection will happen”, “design systems with the expectation that some attacks will succeed”, and the reason input validation isn’t enough — the AI can’t distinguish user input from external content. The last line of defence it lists is verifying risky actions with the user.
• Application card: Microsoft 365 Copilot (Microsoft Learn) — the user-facing transparency document, updated 9 July 2026 (renamed from Transparency note). Useful for the contrast: it asks users to review responses, warns about overreliance and ungrounded content, and lists “indirect jailbreak” among its risk evaluations — but its limitations section never raises the possibility that a referenced document is carrying instructions.
• AgentFlayer: ChatGPT Connectors 0click Attack (Zenity Labs) — the same trick against a different vendor a year earlier: an “invisible prompt injection hiding in a document. 1px white font”, used against ChatGPT’s Connectors. Evidence that the concealment technique, not the product, is the thing to learn.

Editor’s note

Almost every document I work on was written in part or in whole by someone else, such as a counterparty’s markup of a contract. In this day and age, I need to turn my mind to the possibility that some part of what I’m working on may be addressed to an AI assistant rather than to me. We should always be assessing what goes in, then critically considering what comes back out. There is a real divide in how people approach these tools, and I expect the next little while to produce a lot of embarrassing and costly failures caused by a failure to control for this risk.