Copilot for Word Prompt-Injection Worm Self-Propagates Between Documents

Microsoft 365 Copilot for Word

Researcher Håkon Måløy published "Context Collapse, Part 3", showing that instructions hidden in a Word document as white text on a white background in a very small font are stripped of formatting and read by Copilot as part of the user's request. In his demonstration Copilot silently altered financial figures in a report and then copied the hidden instructions into the newly generated document, turning the output into a fresh carrier. If that document is later used as source material in another Copilot session, the instructions fire again and spread further, with no need for the attacker's original file to be present. Måløy reported the behavior to Microsoft's MSRC on March 6, 2026 and published 144 days later. Microsoft deployed multiple mitigations during that window, including a revised editing experience and an upgrade to the underlying model, and said it had addressed the reported findings; Måløy reworded the payload and reproduced the self-propagating behavior after those fixes. No CVE was assigned

Copilot cannot distinguish document content it is asked to summarize from instructions it is asked to follow, and it copies source text into generated output verbatim. Together those two properties give the payload both execution and replication, which is what makes this a worm rather than a one-shot injection. Microsoft's mitigations targeted specific payload wording rather than the underlying trust boundary