A newly disclosed security issue in Microsoft Copilot for Word has raised fresh concerns for enterprise collaboration. The flaw uses hidden prompts inside normal documents. It does not rely on classic malware, macros, or executable files.
Security researcher Håkon Måløy reported the issue to Microsoft in March 2026. The disclosure followed a 144-day coordinated process. Microsoft has added partial mitigations, but researchers say the wider attack method remains active.
The technique starts with text hidden in a Word file. Attackers can format text in white on a white background. Users see a normal document, but Copilot may still read the concealed content.
That hidden text can act as an instruction for the AI assistant. When a user asks Copilot to summarize or edit the file, it may follow the prompt. The result can be a new document carrying similar hidden instructions.
As Radoslav Krehlik, owner at NORAM spol., explains, “the processcreates a self-propagating AI worm that spreads through normal collaboration in SharePoint, Teams, OneDrive, and email.”
This matters because Word documents move across modern workplaces every day. Teams share files through email, SharePoint, Teams, and OneDrive. A trusted-looking document could influence Copilot during routine work.
The disclosure summary states: “No special access is required. Simply opening or referencing the poisoned document is enough.” That makes the issue important for legal, finance, HR, procurement, and customer teams.
For IT and communications teams, the lesson is clear. AI assistants now sit inside collaboration flows. They process business content, not just user commands. That changes how organizations should think about document security.
Companies should treat external documents as untrusted before using them with Copilot. This includes partner files, website downloads, customer attachments, and supplier templates. Staff should also review AI-generated documents before sharing them more widely.
However, the same connected model delivers real value. Copilot can reduce manual searching and speed up document work. It can connect meetings, messages, and files into one useful context.
Yet that connectedness creates a new risk layer. AI tools must separate document data from attacker instructions. This remains difficult when both appear in the same file.
Recent research from Varonis also showed related risks in Microsoft 365 environments. Attackers used crafted links to influence Copilot search behavior. That case also highlighted the challenge of trusted context.
Organizations do not need to abandon AI productivity tools. They should govern them with clearer security rules. Admins can limit availability, adjust connected experiences, and train users on safer workflows.
The bigger message is simple. AI context is becoming part of the security perimeter. Enterprises must control what assistants can read, trust, and act upon.
