Logotype
Back

Hidden Prompt Turns Copilot Docs Into a Worm

Malwarebytes · High sophistication
Last updated July 30, 2026

A security researcher demonstrated that Microsoft Copilot for Word can be tricked by hidden text inside a Word document, causing Copilot to follow attacker instructions. The result is a self-propagating “AI worm” that silently modifies documents and embeds the same hidden prompt into new files, spreading through normal document sharing without traditional malware.

How the attack works

A security researcher demonstrated that Microsoft Copilot for Word can be manipulated through hidden text embedded inside a Word document. The technique involves formatting a JSON-style prompt as white text on a white background, so it is invisible to anyone reading the document normally. When a user opens the file and asks Copilot to draft or edit content based on it, Copilot strips away formatting, reads the hidden text, and treats those embedded instructions as part of the legitimate user request.

The most notable part of this attack is what happens next. Copilot does not just follow the hidden instructions once. It appends the full malicious prompt back into the newly created or edited document as hidden text. That new file then becomes a carrier itself. If it is shared with a colleague, partner, or client who also uses Copilot for Word, the cycle repeats without any traditional malware, macros, or attachments involved.

Why it succeeded

This is not a phishing email with obvious red flags or a malicious executable that antivirus tools can catch. The payload is plain text hidden through simple formatting tricks, and the propagation happens through completely normal, expected behavior: opening a shared document and asking an AI assistant to help edit it. The researcher reports that the worm chain continued to function even after mitigations and newer model versions were introduced, pointing to a broader architectural weakness in how these AI assistants process untrusted document content rather than a single fixable bug.

What to watch for

  • Documents that contain hidden content, such as white text on a white background, invisible during normal reading
  • Copilot output that adds or changes content beyond what was actually requested
  • Newly created or edited documents that may carry embedded hidden instructions without the user realizing it
  • Files shared by external partners, vendors, or clients specifically requesting Copilot-based drafting or editing

Building resistance

Organizations across legal, finance, HR, executive, and general Microsoft 365 user populations should treat externally sourced documents as untrusted before feeding them into Copilot or similar AI assistants. Manual review of attachments before using them as Copilot source material, along with careful verification of Copilot-generated output before it is shared or reused, helps break the propagation chain. For teams that do not rely heavily on Copilot for Word, disabling it entirely (through File, Options, Copilot, and clearing the Enable Copilot checkbox) removes the exposure altogether. Because there is currently no complete mitigation for this class of prompt-injection attack, awareness and cautious document handling remain the most practical defenses available today.

Key findings

  • Attackers can hide a JSON-formatted prompt as white text on a white background in a Word document and have Copilot treat it as instructions.
  • When a user asks Copilot to draft/edit based on the document, Copilot can strip formatting, read hidden instructions, and modify the active document accordingly.
  • Copilot can append the malicious prompt back into the output document as hidden text, making the new file a carrier that spreads through document sharing.
  • The researcher reports the worm chain still worked after Microsoft mitigations and newer model upgrades, suggesting a broader architectural weakness.
  • There is described to be “no complete mitigation” for this class of prompt-injection attacks across similar LLM products.

Who’s being targeted

  • Commonly targeted roles: Executives, Legal, HR, Finance, All Microsoft 365 / Word users, Information Security / Security Awareness.
  • Affected industries: Any organization using Microsoft Word with Copilot, Professional services, Legal, Finance, Healthcare, Education, Government.
  • Attack channels: email.
  • Impersonated: External sender (partner/vendor/client) sharing a Word document for drafting/editing.

Red flags to watch for

  • Document contains hidden content (e.g., white text on white background) that the user won’t notice during normal reading
  • Copilot output unexpectedly adds or changes content beyond the user’s request
  • Newly created/edited documents may contain hidden instructions embedded without the user’s awareness
Try Mirage

Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.

Get a demo

Frequently asked questions

How does the Copilot Word worm actually spread?

Attackers hide a JSON-formatted prompt as white text on a white background inside a Word document. When a user asks Copilot to draft or edit based on that document, Copilot reads the hidden instructions and appends the same hidden prompt into the new output file, turning it into a carrier that spreads through normal document sharing.

Does updating Microsoft Copilot fix this issue?

According to the researcher, the worm chain still worked after Microsoft mitigations and newer model upgrades, suggesting the weakness is architectural rather than a single patchable bug.

Can I just turn off Copilot to avoid this risk?

Yes, disabling Copilot in Word is one way to reduce exposure. In Word, users can go to File, Options, Copilot, clear the Enable Copilot checkbox, and restart Word.

What should employees do before using an external document with Copilot?

Treat documents from outside the organization as untrusted, review them manually before using them as Copilot source material, and carefully verify any Copilot-edited output before sharing or reusing it.

Read the video transcript

Imagine a Word document that quietly reprograms Copilot… and then spreads itself every time you share it. A researcher showed this: attackers hide a JSON prompt as white text on white background in a Word file. When you ask Copilot for Word to draft or edit based on that doc, Copilot strips the formatting, reads the hidden instructions, and quietly rewrites your document. Here’s the nasty part: Copilot can then append that same malicious JSON prompt back into the file as hidden white text. The new document you save and email on becomes a fresh carrier, and the worm chain keeps working even after model updates. Your move: if a document comes from outside the company, read it first, then only use Copilot on it after you’ve reviewed the content, and double-check Copilot’s edits before you hit send.

MITRE ATT&CK techniques

T1204.002 · Malicious File
Original reporting: Malwarebytes
How we produce these breakdowns

Similar attacks

See Mirage in Action?

Discover how Mirage exposes your actual human risk, tests defenses, and drives staff training with modern, realistic attack scenarios, long before adversaries seize the opportunity to breach you.

Get a demo