Microsoft Copilot for Word Spreads a Prompt-Injection Worm

Microsoft Copilot for Word carries a prompt-injection worm that copies itself from document to document, per Enklype Salt.

That matters because the exploit hides inside the workflow every Word user already relies on: opening and editing shared documents. Microsoft took 144 days to disclose the bug, and Enklype Salt says it was still reproducible with new payloads at publication.

The bug starts with hidden white-text instructions buried in a source document.

Opening that file with Copilot's magic pen, or running Edit with Copilot in Work or Work IQ mode, triggers the hidden instructions. Copilot executes them and writes them verbatim into the new document it generates.

Handing that new document to a colleague as source material restarts the cycle, per Context Collapse Part 3.

No firewall or endpoint scanner catches it. The exploit never leaves Word's own document-sharing path.

Enklype Salt reported the flaw to Microsoft on March 6. Microsoft extended the standard 90-day disclosure window twice, pushing publication to July 28.

The post hit 369 points on Hacker News.

Microsoft shipped two mitigation attempts in that stretch, including an upgrade to the underlying model, GPT-5.5.

Microsoft's fixes targeted the model. The actual carrier is the document format, and nothing in the write-up says Word changed how it handles hidden text before Copilot reads it.

Patch the model and the same trick works with a new phrasing next month. Strip or flag hidden-text instructions before they reach the assistant, and the propagation stops regardless of which model runs it.

Enklype Salt doesn't say whether Microsoft has any plan to change how Word parses formatting before content reaches Copilot.