- › Norwegian researcher Hakon Maloy hid a JSON prompt as white text on a white background inside a Word document, and Copilot for Word read it as an instruction from the user.
- › Copilot then wrote the same hidden prompt into the document it produced, so every file created from that source became a new carrier.
- › He reported it to Microsoft on March 6, 2026 and published on July 28 after 144 days, during which Microsoft shipped mitigations and upgraded the model without closing the class of attack.
- › No macro runs, no executable lands, and no attachment gets blocked, so none of the controls built for document malware see any of this.
- › The controls that work are boring: treat inbound documents as untrusted input to the model, strip hidden formatting on ingest, scope what the assistant can reach, and log what it writes.
Think about the proposal template your team has reused since 2023. Somebody built it, somebody improved it, and now every new proposal starts as a copy of the last good one. Nobody reads it top to bottom anymore, because reading it is exactly the work the template exists to skip. That reuse loop is the point of a template library, and it’s also the propagation mechanism for the attack a Norwegian researcher published last week.
On July 28, Hakon Maloy disclosed a proof of concept against Microsoft Copilot for Word. He hid a prompt formatted as JSON inside a Word document, rendered as white text on a white background. When a user asked Copilot to draft or edit based on that document, Copilot stripped the formatting, read the hidden text along with everything else, and treated those instructions as part of the user’s request. Then it did the part that matters. It wrote the full malicious prompt back into the document it produced, again as hidden white text. The new file works exactly like the old one. Anyone who feeds it to Copilot triggers the same behavior.
Maloy reported it to Microsoft on March 6, 2026. He published 144 days later. Microsoft acknowledged the behavior, shipped multiple mitigations during that window, and upgraded the model underneath Copilot. Modified payloads kept reproducing the attack class anyway.
Why Your Document Controls Cannot See This
Run through what your organization actually inspects on an inbound Word file. Macro execution policy. Attachment sandboxing. Signature matching against known malicious payloads. Maybe an outbound rule if the file phones home.
Now count how many of those fire here. Zero. There’s no macro. No executable lands on disk. Nothing beacons out. The payload is plain text that happens to be the same color as the page, in a document that is structurally valid and behaviorally identical to every other .docx in the building. The file is not the weapon. The file is a letter, and the model is the only thing in the building that reads it and does what it says.
We have thirty years of tooling built on the assumption that a document is inert until something executes. Copilot broke that assumption in the most ordinary way possible, by being useful. The whole product promise is that it reads the document for you. Reading the document is the vulnerability.
The Bent Fixture
I spent years around fabrication before I did this work, and the closest thing I’ve seen to this is a bent fixture.
A fixture is the jig that holds a part while you cut it. Every part that comes off it inherits its geometry. Bend one by a few thousandths and nothing looks wrong. The parts come out, they pass a visual check, they get boxed. Then somebody uses one of those parts as the reference to build the next fixture, and the error is now in two places. Two weeks later you have a defect in your product that traces back to one piece of tooling nobody thought to measure, because tooling is the thing you check parts against, not the thing you check.
A template is a fixture. So is a boilerplate contract, an approved statement of work, a standard incident report, a shared meeting-notes format. They exist so people stop inspecting them. That is their entire value, and it’s the reason a payload that copies itself into the next document has a longer runway inside a well-organized company than a badly organized one. The better your document governance, the more reliably the thing propagates.
Now Put Yourself in the Adversary’s Shoes
Look at the cost structure. A phishing campaign with a malicious attachment burns infrastructure, gets sandboxed, gets a signature, and dies in about a week. You pay for domains, you pay for hosting, and you pay again every time a payload gets burned.
Compare that to sending one clean, legitimate, genuinely useful document into an organization. A vendor questionnaire. A revised contract. A conference agenda. It passes every control you own because it isn’t malicious by any definition your tools use. It gets saved to SharePoint. Somebody asks Copilot to summarize it. From there it moves through the document graph on its own, carried by employees doing their jobs correctly, with no further spend from the adversary at all.
That’s a delivery mechanism with near-zero marginal cost and a very long dwell time. Rational operators go where the math goes. This is the same lesson we drew from vendor supply chain risk: the cheapest way into a hard target is through something the target already trusts and no longer inspects.
What Actually Reduces the Blast Radius
None of this is an argument against Copilot, and I’m not going to pretend the answer is turning off the assistants. The productivity is real and your competitors are keeping theirs. The answer is treating the model like what it is, which is a program that executes text supplied by strangers.
Treat every inbound document as untrusted model input. You already have a mental category for untrusted input on your web forms. Documents from outside the company now belong in that category. That’s a policy change and a training change before it’s a tooling change.
Strip hidden formatting on ingest. Anything arriving from outside gets normalized before it touches a document library: white-on-white text flattened, hidden runs removed, comments and tracked changes resolved or stripped. This is unglamorous and it kills the specific technique Maloy demonstrated.
Scope what the assistant can reach. An assistant with access to one project folder produces a contained problem. An assistant with tenant-wide read and write produces an unbounded one. Ask what a hostile instruction could accomplish with the permissions your deployment holds today, because that is the actual blast radius. We covered this failure mode in AI agents with full access.
Log what the model writes, not just what users type. Most Copilot telemetry answers “who used it.” You need “what did it change.” A model appending content that no human authored is a detectable event if anybody is looking for it.
Quarantine the template library. Master templates get a controlled path: one owner, changes reviewed, no round-tripping through an assistant. Every document reused more than a handful of times deserves the same treatment you give a signed binary.
The Part Worth Sitting With
Maloy gave Microsoft 144 days. Microsoft is not a company that lacks resources or motivation here, and they shipped fixes and a better model, and the class of attack survived all of it. That should tell you where to spend. When the vendor cannot reliably filter hostile instructions out of content the model is designed to read, the durable control is not detection. It’s limiting what the model is allowed to do once it has been convinced.
Go look at what your Copilot deployment can write to today.
Want a clear picture of where your organization’s people and processes are exposed? Take our free Human Attack Surface Score assessment, or contact us for a full risk assessment.
Operating on the philosophy that 'you can't build a secure system if you don't know how to break it,' Chris leads our engineering division. A top 1% National Cyber League competitor, he hardens our digital infrastructure against the very exploits he has mastered.
View Author Page →
