A hidden Word prompt can turn Copilot documents into carriers
A malicious Word file does not need a macro to alter the next report. In the demonstrated flow, invisible instructions can survive a Copilot edit and hitch a ride into the document that replaces it.
A coordinated disclosure describes prompt injection in Copilot for Word: a document can hide instructions in white-on-white text, influence a generated report, then cause Copilot to copy those instructions into the output. That output becomes the next carrier when someone uses it as source material.
The uncomfortable shift is from a bad attachment to a poisoned internal artifact. The author says Microsoft reproduced the broader class after multiple mitigations; the immediate defensive rule is to treat external files as untrusted context, not just untrusted downloads.
The document that rewrites its successor
Håkon Måløy's disclosure describes a Word-specific prompt-injection chain disclosed through Microsoft Security Response Center coordination. The starting document can contain attacker-controlled instructions rendered as tiny white text on white. A person may not see it, but Copilot receives the text after formatting is stripped.
The proof of concept asks Copilot to alter a financial report and then append the instruction to the newly created document in concealed text. When a colleague later uses that internally generated document as Copilot context, the same instruction can fire again. The original attachment is no longer necessary.
The security boundary is the attachment
This is not a claim that a Word document executes code. It is a claim that a model handling an attachment can confuse data inside that attachment with instructions about the current task. The author reports that the issue reproduced in both attachment-driven and relevant-document workflows, including a case where Copilot found a document in OneDrive.
The HN discussion immediately focused on the design choice behind the exploit: hidden formatting is a presentation feature for people, while the model is given normalized text. That mismatch makes a normal review insufficient when the source document becomes model context.
A provenance problem, not just a prompt problem
The author says that two mitigation attempts raised the bar for particular payloads but did not close the broader propagation mechanism. Microsoft should be understood here as having collaborated on the disclosure; the report says no customer-side action fully addresses the class at publication.
For teams using document assistants, the practical control is narrow but real: limit externally sourced files in Copilot workflows, inspect generated documents before reuse, and preserve which source files informed a model edit. Once a legitimate-looking internal report becomes the carrier, ordinary trust signals point in exactly the wrong direction.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
This is the last story in the July 30, 2026 issue.
Go to the issue archive