Overview
- A security researcher publicly disclosed a proof of concept on July 28 showing that hidden JSON prompts placed as white text inside Word files can be read by Microsoft 365 Copilot when Word strips formatting.
- When a user asks Copilot to draft or edit using a file that contains the hidden prompt, Copilot can alter the document and append the same concealed instructions into the new file so the malicious prompt can trigger again in later sessions.
- Microsoft confirmed the behavior to the researcher and rolled out mitigations including blocking the original prompt wording and upgrading the model to GPT‑5.5, but the researcher says he reproduced the propagation chain on later models and judges the class still exploitable.
- There are no public reports of real‑world exploitation and no public CVE or standalone Microsoft advisory at the time of publication, and the researcher withheld the full payload from public disclosure.
- The attack exposes an architectural weakness in LLM grounding because attacker content shares the model context with trusted instructions, which breaks provenance, can evade normal malware controls, and pushes defenders to use procedural safeguards such as treating external documents as untrusted, reviewing Copilot outputs, or disabling Copilot.