Microsoft Copilot Vulnerable to Hidden Prompt Injection

A security vulnerability has been identified in Microsoft 365 Copilot, allowing hidden instructions within a Word document to be copied into new files generated by the AI assistant. Håkon Måløy, a security researcher, disclosed this technique on July 28, detailing how these hidden prompts can influence Copilot's output. Måløy reported the issue to Microsoft 144 days prior to its public disclosure. His proof-of-concept demonstrated that a document containing these embedded instructions, when used in a subsequent Copilot drafting session, would replicate the same behavior. This means that if a user crafts a document with specific, hidden directives for Copilot to follow—such as altering figures in a report—those same directives can be transferred to a newly generated document. This capability raises significant concerns about prompt injection attacks, where malicious actors could embed harmful instructions into documents that, when processed by Copilot, could lead to unintended or malicious outcomes in subsequent documents. The vulnerability specifically affects how Copilot interprets and processes content within Microsoft Word, a widely used application for document creation and editing. Microsoft 365 Copilot is designed to assist users with various tasks, including drafting text, summarizing information, and generating content based on user prompts and existing document data. The ability for hidden instructions to persist and be replicated across documents suggests a potential loophole in how Copilot sanitizes or interprets user-provided content, especially when that content is not immediately visible to the end-user. The implications of this discovery are far-reaching, as it could enable attackers to manipulate Copilot's behavior without the user's explicit knowledge or consent. For instance, a compromised document could contain hidden instructions to subtly alter data, introduce biased language, or even attempt to exfiltrate sensitive information through subsequent AI-generated content. The researcher's proactive reporting to Microsoft indicates a responsible disclosure process, aiming to give the company time to address the vulnerability before widespread exploitation. The exact mechanism by which these hidden prompts are embedded and then replicated by Copilot is a critical area for further investigation by Microsoft. Understanding this process is key to developing effective countermeasures and ensuring the integrity of AI-assisted document creation. The incident underscores the ongoing challenges in securing AI systems, particularly those integrated into widely used productivity suites where the potential attack surface is vast. As AI tools become more deeply embedded in workflows, the security of their underlying mechanisms and their interaction with user-generated content will remain a paramount concern for both technology providers and end-users.