Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents

Microsoft Copilot for Word has a vulnerability that allows hidden instructions within a Word document to be copied into new documents and then re-introduced during subsequent Copilot drafting sessions. This allows an attacker to inject malicious commands into a document, which Copilot then incorporates into its output. Microsoft has deployed mitigations, but the vulnerability remains exploitable as it requires a Copilot drafting or editing operation and relies on the model processing attacker-controlled content. No specific CVE or advisory exists at the time of publication.