Microsoft Copilot for Word Self-Replicating Prompt Injection: Detection and Mitigation

On July 28, 2026, researcher Håkon Måløy disclosed a critical manipulation technique affecting Microsoft 365 Copilot within Word. The disclosure comes 144 days after the issue was reported to Microsoft, highlighting a persistent gap in AI input sanitization.

The core threat is a "self-replicating" prompt injection attack. By embedding hidden instructions within a Word document—using text colored to match the background or minute font sizes—attackers can manipulate Copilot into rewriting content while simultaneously copying those hidden instructions into the newly generated file. When this new document is used in subsequent Copilot sessions, the cycle repeats, creating a chain of compromise that propagates malicious instructions across an organization's document ecosystem without user intervention.

For defenders, this represents a shift from static document macros to dynamic, context-aware AI abuse. The risk is not just data leakage, but the corruption of business intelligence and the potential for Copilot to execute unauthorized actions (e.g., unauthorized data retrieval or summarization) via persistent, invisible prompts.

Technical Analysis

Affected Products: Microsoft 365 Copilot integrated with Microsoft Word (Web and Desktop clients).
Underlying Vulnerability: Logic flaw in Copilot's context ingestion. The AI model parses the entire document content, including non-rendered text (hidden via formatting), and incorporates it into the context window used for generation.
Attack Chain:
1. Initial Compromise: An attacker creates a Word document containing malicious instructions hidden via formatting (e.g., white text on a white background).
2. Context Injection: A user utilizes Copilot to generate or rewrite content based on the infected document.
3. Replication: Copilot processes the hidden text as part of the instructions and generates the new output. Crucially, it includes the hidden instructions in the response text.
4. Persistence: The saved output document now carries the hidden instructions. When shared with another user or processed by Copilot again, the behavior persists.
Exploitation Status: Proof-of-Concept (PoC) confirmed by Måløy. The PoC demonstrates that the infection survives the generation process, effectively creating a "worm-like" capability within the M365 environment without traditional malware execution.
CVE Identifier: No CVE has been assigned at the time of this disclosure.

Detection & Response

Detecting this behavior requires a shift in strategy. Traditional EDR focuses on process execution; here, the threat resides in document structure and cloud AI interactions. We must hunt for the automated creation of these infected documents and analyze the internal structure of files entering the environment.

Sigma Rules

These rules target the automated creation of "infected" documents (using PowerShell/COM objects) and the mass utilization of Copilot in a way that suggests bulk processing.

YAML

---
title: Potential Automated Creation of Malicious Word Documents
id: 9a1b2c3d-4e5f-6789-0a1b-2c3d4e5f6789
status: experimental
description: Detects PowerShell scripts interacting with Word COM objects, often used to automate the creation of documents with hidden text or prompt injections.
references:
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/07/29
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Word.Application'
      - 'Microsoft.Office.Interop.Word'
  condition: selection
falsepositives:
  - Legitimate administrative scripting for document management
level: medium
---
title: High Volume Copilot Document Generation
id: 0b1c2d3e-4f5a-6789-1b2c-3d4e5f6a7b8c
status: experimental
description: Detects anomalous patterns of file creation potentially indicative of bulk AI processing or prompt injection propagation attempts.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/07/29
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: microsoft365
  service: word
detection:
  selection:
    Operation|contains: 'Copilot'
    EventType: 'FileCreated'
  timeframe: 5m
  condition: selection | count() > 10
falsepositives:
  - Legitimate bulk report generation by power users
level: high

KQL (Microsoft Sentinel)

This query hunts for specific keywords associated with prompt injection within the audit logs of Microsoft 365, specifically looking at Copilot interactions.

KQL — Microsoft Sentinel / Defender

OfficeActivity
| where Workload == "MicrosoftWord" and Operation has "Copilot"
| project TimeGenerated, UserId, ClientIP, Operation, OfficeObjectId
| join kind=inner (
    OfficeActivity
    | where Workload == "SharePoint" and Operation == "FileUploaded" or Operation == "FileModified"
    | project TimeGenerated, SourceFileName = OfficeObjectId, UserId
) on UserId
| where TimeGenerated1 between (TimeGenerated - 5m) .. (TimeGenerated + 5m)
| mv-expand todynamic(AdditionalProperties)
| where AdditionalProperties has "hidden" or AdditionalProperties has "instruction"
| summarize count() by UserId, bin(TimeGenerated, 1h)
| where count_ > 5

Velociraptor VQL

This artifact hunts for .docx files that contain hidden text elements by inspecting the underlying XML structure. It looks for <w:vanish/> tags (explicitly hidden) or specific color formatting often used in these attacks.

VQL — Velociraptor

-- Hunt for Word documents with hidden text structures indicating potential prompt injection
SELECT FullPath, Size, Mtime
FROM glob(globs='*/**/*.docx', root=srcDir)
WHERE 
  -- Upload the file to memory to inspect as a zip
  upload(file=FullPath, name=FullPath).Data
    
LET docx_files = SELECT FullPath
FROM glob(globs='**/*.docx', root=srcDir)

LET inspect_docx = SELECT 
    FullPath,
    Content.Name AS XMLPath,
    Content.Data AS RawXML
FROM foreach(row=docx_files, 
    query={
        SELECT FullPath, Data
        FROM zip(filename=FullPath)
        WHERE Name =~ "word/document.xml" OR Name =~ "word/header\*.xml"
    })

SELECT 
    FullPath,
    XMLPath,
    "Potential Hidden Text Detected" AS Finding
FROM inspect_docx
WHERE RawXML =~ "<w:vanish/>" 
   OR RawXML =~ "w:color.*w:val=\"FFFFFF\""
   OR RawXML =~ "w:sz.*w:val=\"2\""

Remediation Script (PowerShell)

This script scans a directory for .docx files and attempts to identify if they contain hidden text patterns (specifically white font color) by inspecting the XML, helping quarantine infected files.

PowerShell

# Scan for documents with potential hidden text patterns
param(
    [string]$TargetDirectory = "C:\Users\",
    [string]$LogFilePath = "C:\Logs\CopilotScan.log"
)

function Test-HiddenTextInDocx {
    param ([string]$FilePath)

    try {
        # Add-Type -AssemblyName System.IO.Compression.FileSystem
        $zip = [System.IO.Compression.ZipFile]::OpenRead($FilePath)
        $entry = $zip.Entries | Where-Object { $_.FullName -eq 'word/document.xml' }

        if ($entry) {
            $stream = $entry.Open()
            $reader = New-Object System.IO.StreamReader($stream)
            $xmlContent = $reader.ReadToEnd()
            $reader.Close()
            $stream.Close()
            $zip.Dispose()

            # Check for white text color (FFFFFF) or vanish tags
            if ($xmlContent -match 'w:color.*w:val="FFFFFF"' -or $xmlContent -match '<w:vanish/>') {
                return $true
            }
        }
        $zip.Dispose()
    }
    catch {
        Write-Warning "Error reading $_: $_"
    }
    return $false
}

Write-Output "Starting scan for hidden prompt injections in $TargetDirectory"
Get-ChildItem -Path $TargetDirectory -Recurse -Filter *.docx | ForEach-Object {
    if (Test-HiddenTextInDocx -FilePath $_.FullName) {
        $msg = "POTENTIAL THREAT DETECTED: $($_.FullName)"
        Write-Output $msg
        Add-Content -Path $LogFilePath -Value $msg
    }
}

Remediation

Vendor Coordination: Monitor the official Microsoft 365 Roadmap and Security Advisory for updates regarding this issue (disclosed July 28, 2026). Microsoft may release a backend update to Copilot to ignore non-rendered text or a patch for Word.
Data Loss Prevention (DLP): Configure Microsoft Purview Information Protection to scan documents for patterns of "invisible" text. While difficult, creating a policy that flags documents with specific XML structures (if supported by your DLP solution) can help identify carrier files.
Restrict Copilot Scope: Limit Copilot access to libraries containing highly sensitive or unverified data. Use "Data by Design" restrictions to prevent Copilot from ingesting documents from untrusted sources or internet-facing SharePoint sites.
User Awareness: Train staff to recognize that "Copy-Pasting" content from external sources into Copilot-enabled documents introduces risk. Users should be suspicious if Copilot generates text that includes irrelevant instructions or repetitive formatting.
Sanitization: Implement document sanitization protocols (using tools like Microsoft Defender for Office or third-party scrubbers) for incoming documents, stripping metadata and hidden formatting before they are used in internal AI sessions.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub