Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents

Security researcher Håkon Måløy revealed that Microsoft 365 Copilot for Word can inadvertently copy hidden instructions embedded in documents into new drafts, potentially altering content without user awareness. Microsoft confirmed the issue, deployed mitigations including upgrading to GPT-5.5, but the vulnerability persists with newer model versions as of July 28, 2026.