A newly disclosed technique reveals that hidden instructions embedded in a Microsoft Word document can manipulate Microsoft 365 Copilot not only to alter generated content, but also to copy those instructions into the output file—turning each Copilot-assisted document into a potential carrier for persistent, self-propagating attacks.
Security researcher Håkon Måløy publicly detailed the method on July 28, after reporting it to Microsoft 144 days prior, as covered by The Hacker News. In his proof-of-concept, a source document with concealed prompts directed Copilot to modify figures in a business report. The resulting document inherited the same hidden instructions; when later used in another Copilot session, it triggered identical manipulative actions automatically.
This vulnerability exploits an indirect prompt-injection vector that blurs the line between untrusted document content and the AI’s reasoning pipeline. Copilot processes the entire text of an opened file as context, allowing instructions invisible to humans to steer its actions. The assistant then serializes these instructions into new documents, making every generated file a potential vehicle for further contamination.
For organizations using Copilot for drafting reports, summaries, or policies, the risks are immediate. A single tainted file introduced via email or shared storage could lead to data falsification, disinformation injection, or workflow sabotage, with each Copilot-assisted edit potentially spreading the payload further.
The 144-day gap between disclosure and public report, with no patch announced, highlights a critical delay in AI security response. Until Microsoft implements stronger input sanitization or output filtering, the integrity of Copilot-generated documents remains compromised when source materials are untrusted.
This issue underscores a broader architectural challenge in LLM-integrated tools: balancing deep content understanding with strict isolation of untrusted instructions. When that isolation fails, the attack surface shifts to the data layer, bypassing traditional security controls.
Defensive measures are currently limited. IT administrators can scrutinize external documents, restrict Copilot use on sensitive files, and review AI-generated output manually. The open-source community should explore and develop standardized techniques for instruction sanitization in document contexts, advocating for industry-wide standards to address this gap at the data layer.
Måløy’s demonstration confirms that prompt injection extends beyond chat interfaces into document creation. As generative AI tools become integral to business workflows, the documents themselves can facilitate persistent influence campaigns. Until vendors bridge the ingestion-emission loop, every Copilot-assisted file carries inherent integrity risks that demand urgent attention and proactive mitigation from both vendors and the community.
一項新揭露的技術揭示，嵌入在微軟Word文件中的隱藏指令，不僅能操控微軟365 Copilot修改生成的內容，更能將這些指令複製到輸出文件中——使每份由Copilot協助生成的文件，都成為持續性自我散播攻擊的潛在載體。
安全研究人員Håkon Måløy在向微軟報告此問題144天後，於7月28日公開詳述了此方法，相關報導見於The Hacker News。在其概念驗證中，一份含有隱藏提示的源文件指示Copilot修改商業報告中的數據。生成的文件繼承了相同的隱藏指令；當該文件稍後在另一個Copilot會話中使用時，會自動觸發相同的惡意操作。
此漏洞利用了間接prompt injection向量，模糊了不受信任文件內容與AI推理管道之間的界線。Copilot將已開啟文件的完整文本作為上下文處理，使得對人類不可見的指令能引導其操作。該助手隨後將這些指令序列化到新文件中，使每個生成的文件都成為進一步污染的潛在載體。
對於使用Copilot起草報告、摘要或政策的組織而言，風險迫在眉睫。通過電子郵件或共享儲存引入單一受污染文件，可能導致數據偽造、虛假資訊注入或工作流程破壞，且每次Copilot協助的編輯都可能進一步擴散惡意載荷。
從漏洞披露到公開報告之間長達144天的間隔，且未公布任何修補程式，凸顯了AI安全響應的關鍵延遲。在微軟實施更強的輸入清理或輸出過濾之前，當源材料不受信任時，Copilot生成文件的完整性仍然受到損害。
此問題凸顯了LLM整合工具面臨的更廣泛架構挑戰：如何在深度內容理解與嚴格隔離不受信任指令之間取得平衡。當這種隔離失效時，攻擊面將轉移到數據層，繞過傳統安全控制措施。
目前防禦措施有限。IT管理員可審查外部文件、限制在敏感文件上使用Copilot，並手動檢查AI生成的輸出。開源社群應探索和開發文件環境中指令清理的標準化技術，倡導建立全行業標準，以在數據層面解決此漏洞。
Måløy的演示證實，prompt injection已超越聊天介面，延伸至文件創建領域。隨著生成式AI工具成為商業工作流程不可或缺的一部分，文件本身便可能促成持久的影響力活動。除非供應商打通數據攝取-輸出循環，否則每個由Copilot協助的文件都存在固有的完整性風險，需要供應商和社群緊急關注並採取主動緩解措施。