A security researcher has demonstrated a worm-like prompt injection attack against Microsoft Copilot for Word. The attack hides instructions inside a document using white text on a white background at a tiny font size, making them invisible to readers but still legible to Copilot.
When a user asks Copilot to use the poisoned document as a source, the assistant follows the hidden instructions and copies them into a new file. That file can then become a carrier for the same attack if someone else uses it as a template or source material.
Researcher Håkon Måløy said Microsoft confirmed the behavior on March 31. According to The Decoder, two fix attempts failed, and Måløy published his findings after 144 days while withholding the exact payload text.
The case is a concrete example of why prompt injection remains hard to solve. AI assistants that read user documents can inherit instructions from content that humans cannot see, and ordinary file-sharing workflows can spread those instructions beyond the original target.