AIDEFEND in Action AIA-0071 Validated Research Published: Aug 25, 2026

Copilot for Word Turned a Hidden Prompt into a Document-Borne AI Worm

A white-on-white prompt inside a Word document survived formatting removal, silently changed financial figures, and copied itself into Copilot's newly generated document. The output could then carry the prompt into a later Copilot workflow. This is not autonomous network propagation: every hop still depends on a user or retrieval process bringing the carrier document back into drafting or editing.

Indirect Prompt InjectionInput ValidationHuman-in-the-LoopAI CopilotsEnterprise AI
5 applicable AIDEFEND defenses
Source: Context Collapse, Part 3 - AI Worming through Word 
Author: Håkon Måløy
Original article: Jul 28, 2026

Threat Analysis

  • The carrier looked like an ordinary Word document. The researcher placed JSON-formatted instructions in small white text on a white background. A person viewing the page would not normally see them.
  • Copilot removed the presentation layer but retained the text. When the document entered a Copilot for Word drafting or editing operation, formatting was stripped before model processing. The hidden text therefore became model-readable context and competed with the user's visible request.
  • The proof of concept changed values in a mock financial document. Copilot followed the injected instruction and silently divided financial figures by two. The security impact is document-integrity loss, not merely an unwanted chatbot reply.
  • The same hidden prompt was copied into the new document. If that output was later attached, uploaded, or selected as relevant context for another Copilot operation, the instruction could run again. The carrier propagates through document reuse; it does not independently search for files or victims.
  • Mitigation did not close the class in the reported tests. The researcher reported the issue to MSRC on March 6. Microsoft applied mitigations and model updates in April and July, yet the July 14 mitigation upgraded the underlying model to GPT-5.5 and Måløy reproduced the complete attack using GPT-5.6 on July 15.
  • The evidence remains controlled research. The source shows the carrier design, observed content change, and copy-forward behavior, but does not report an in-the-wild campaign or publish the complete attack prompt.

Applicable AIDEFEND Defenses (5)

AID-H-018.003
High-Impact Independent Validation & Approval Gate
High
Before applying material edits to financial or other controlled content, independently compare the exact proposed changes with the visible user request. Unexplained value changes should require a fresh, change-specific approval rather than relying on the original request to edit the document.
AID-H-006.002
Text, Markup & Structured Output Sanitization and Release Gate
Medium
Use G004 full_response mode on the complete generated text before an Office adapter assembles or distributes the document. Supply a separately verified detector-status adapter and checks for copied instructions. This text gate does not parse DOCX packages, compare visible and hidden Word runs, or verify financial figures. Those document-specific inspections and approval of material edits require separate controls; a missed instruction can still propagate.
AID-H-016.001
System Prompt Structure & Instruction/Data Separation
Medium
Use the actual prompt serializer to place all extracted document text in a data-only namespace and escape structural delimiters. This prevents syntactic breakout into trusted instructions; it does not prevent the model from following ordinary malicious prose inside that namespace. Recheck every reused document and independently authorize material edits and output release. Microsoft-managed deployment requires provider support.
AID-H-002.002
Inference-Time Prompt & Input Validation
Medium
Apply G004 at the exact extracted-document text boundary before model dispatch, initially and on reuse. A separately calibrated moderation service must flag task switching and prompt-copying intent. Its authenticated decision must bind the request and policy; errors deny admission. The HTML-specific G008 fetch/sanitizer does not parse DOCX or detect white-on-white Word text.
AID-D-001.001
Per-Prompt Content, Intent & Obfuscation Analysis
Medium
Scan the exact text extracted from each attached or retrieved Word document before initial use and every later reuse. G001 can supply a content-bound finding for task switching or prompt-copying intent, but it does not inspect DOCX formatting, detect white-on-white text or compare the human-visible document with the extracted text. These Office-specific adapters are separate prerequisites. Before admission, independently require every necessary classifier category and a finite score in the valid range. The current G001 sample can return PASS/NO_FINDING for empty results, missing categories or NaN scores; treat these as errors and refuse admission. This additional result-contract validation is not implemented by the published sample. False negatives still require separate tool and output controls.

What Defenders Should Do Now

  • Inventory every Copilot workflow that attaches, uploads, retrieves, summarizes, edits, or generates Office documents. Record where formatting is removed and which text actually reaches the model.
  • Create regression documents with white-on-white text, tiny fonts, off-page objects, hidden runs, and copied JSON instructions. Verify both the model response and the underlying generated file, not only the visible preview.
  • Require source text to enter prompt assembly as untrusted data under a separate schema field. Do not let document text create system, policy, tool, or workflow instructions.
  • For financial and other controlled documents, generate a semantic diff and require approval for value changes that the user's visible request does not explain.
  • Before saving or sharing generated documents, inspect the complete package for invisible text and source-derived instructions. Fail closed when the review surface and stored file disagree.
  • Track model and policy revisions in the regression record. The source reproduced the class after several mitigations, so a one-time model upgrade is not sufficient evidence of closure.

Conclusion

The distinctive failure is that hidden document text can influence a drafting task and then survive in a new carrier. Financial changes require independent, exact-change approval; generated text needs a full-response release gate before document assembly; and saved Word artifacts need separately implemented checks for hidden content. Structural prompt separation supports these controls but does not guarantee model obedience. The current text-gate sample does not provide DOCX inspection, and a missed payload can still propagate when a document is reused.

Last updated: