Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents

Microsoft 365 Copilot can copy hidden instructions from a Word document into a new file, potentially allowing unwanted actions such as rewriting figures in a report. This issue was disclosed by Håkon Måløy, who reported it to Microsoft 144 days prior. Måløy demonstrated this technique with a proof of concept, showing that the behavior can be triggered in subsequent Copilot sessions using the internally generated file. The hidden instructions can be copied into the finished document, allowing the unwanted actions to persist.