Microsoft Fails to Fully Fix Copilot for Word Vulnerability After 144 Days

Since late March 2026, Microsoft has been coordinating with independent security researcher Håkon Måløy to address a prompt injection vulnerability in Copilot for Word. The attack involves embedding malicious instructions in a Word document as white text on a white background, which are invisible to humans but readable by the AI model. When such a file is used as a source in a Copilot session, the instructions execute silently, and the output document itself becomes a new vector for the attack. This allows the infection to propagate through internal workflows without the attacker's further action, as colleagues unknowingly use the contaminated files. Microsoft deployed a first fix in early April and a second in July, which included upgrading the underlying model to GPT-5.5, but Måløy was able to reproduce the attack each time with slightly modified prompts. The researcher argues that the vulnerability is architectural and common to current LLM systems, requiring more than a simple patch. Microsoft advises users to consider any external document as untrusted and to carefully review AI-generated files before sharing them.