Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents
What happened
Microsoft 365 Copilot for Word can inherit hidden prompt instructions embedded in a document, then replicate those commands when creating new content. Security researcher Håkon Måløy demonstrated how Copilot rewrote figures in a report by following concealed prompts inside the original file, then copied the same behavior into newly generated documents during a second usage. The technique was disclosed publicly 144 days after being reported to Microsoft.
Why it matters
This reveals a hidden persistence risk in Copilot’s document handling. Unlike typical prompts that expire with a session, instructions embedded in Word files can silently influence AI outputs even across files derived from that source. That could lead to unintended or covert manipulations of reports, proposals, or analyses by AI agents. For users, operators, and auditors, it means content created with Copilot could carry over instructions without clear visibility or control.
This erodes trust models around AI-generated documents, complicating efforts to audit or verify the source and integrity of the content. It also raises security and compliance concerns, especially in regulated or sensitive environments where undisclosed prompt injections might steer AI outputs in ways that defy transparency or policy.
What to watch next
Microsoft’s response to this prompt leakage will be critical. Will they introduce controls to detect and remove hidden instructions in documents used by Copilot? The effectiveness of AI document auditing tools and governance frameworks will also come under pressure to adapt. Operators relying on Copilot must weigh the benefits of AI assistance against new risks of prompt persistence and content manipulation.
Builders should monitor whether this technique can be exploited at scale or combined with other vectors for misinformation or unwanted behavior. Investors and buyers need to consider how such quirks affect the trustworthiness and risk profile of AI productivity tools. Observers should watch for similar prompt persistence risks across other document-centric AI platforms.
AI Quick Briefs Editorial Desk
