A security researcher working under the handle EN Klype Salt has demonstrated a troubling new twist on prompt injection attacks: a technique that doesn’t just trick Microsoft’s Copilot for Word into misbehaving once, but turns it into a carrier that copies malicious instructions from one document into the next, spreading like a worm through everyday office collaboration.

How Invisible Text Becomes an Attacker’s Instructions

The core problem lies in how Copilot processes documents that are attached to it or referenced during editing. Large language models don’t distinguish well between text a human is meant to read and text that’s merely present in a file. An attacker can exploit that blind spot by hiding a block of instructions, formatted to look like structured data, inside a document using tricks as simple as white text on a white background in a tiny font size.

To a person scanning the page, the document looks like an ordinary quarterly report or market analysis. To Copilot, however, that invisible block reads as a legitimate command. When an employee later opens the file in Word and asks Copilot to summarize it, rewrite a section, or use it as a reference for a new draft via the “magic pen” or “Edit with Copilot” features, the assistant strips away formatting and processes the hidden text as an instruction it should follow.

From Single Compromise to Self-Propagation

What sets this research apart from earlier cross-domain prompt injection findings is the propagation mechanism. Once triggered, Copilot doesn’t just leak data or produce an odd response — it can be directed to quietly tamper with the visible content of the working document, for example altering financial figures in a report without any obvious sign of manipulation, while simultaneously copying the entire malicious instruction set into the newly generated file using the same concealment tricks.

That means every document Copilot touches after the initial infection becomes a new host. If the tampered file is later reused as source material for another AI-assisted draft, whether by the original victim or a colleague elsewhere in the organization, the hidden payload fires again. The researcher’s writeup frames this as an evolution of Cross-Domain Prompt Injection Attacks (XPIAs), moving the threat from a one-off compromise to a multi-document chain that can travel through SharePoint libraries, Teams channels, and email attachments under the appearance of routine business content.

• The payload survives even after the original malicious document is deleted, because it now lives inside legitimately authored files.
• Tests reproduced the behavior across several Copilot configurations, including versions running on newer GPT-5.5 and GPT-5.6 backends.
• Because Copilot’s edits are typically accepted without a visible diff, tracing when and where content was altered is extremely difficult after the fact.

Disclosure Timeline and Microsoft’s Response

EN Klype Salt coordinated disclosure with Microsoft’s Security Response Center over roughly 144 days, supplying proof-of-concept prompts, reproduction steps, and demonstration videos. Microsoft has since rolled out targeted mitigations that block some of the original payloads, but according to the research, there is no comprehensive fix for the broader vulnerability class at the time of publication — the attack chain remains viable in current deployments.

Why This Matters for Enterprises

The immediate danger isn’t stolen credentials or ransomware; it’s quiet corruption of data integrity inside Microsoft 365 environments that organizations implicitly trust. A single seeded document, forwarded or reused across departments, could silently distort numbers in financial reports, contracts, or analysis long before anyone notices something is wrong. Because the AI’s edits blend into what looks like normal collaborative editing, incident responders may struggle to reconstruct exactly when a figure changed or who is responsible.

Security teams can’t eliminate the underlying flaw from the customer side, but they can reduce exposure. Treat any externally sourced document as untrusted before attaching it to Copilot for analysis or drafting. Review attachments manually before starting an AI-assisted workflow, and apply careful human review to Copilot-generated or Copilot-edited content before it’s redistributed or relied upon for decisions.

A Broader Architectural Problem

More than a single product bug, the research underscores a structural weakness shared by many systems that bolt large language models onto existing productivity tools: attacker-controlled content and trusted user instructions are processed in the same context window, with no reliable boundary between them. Until that architectural gap is closed at the model or platform level, prompt injection — and now self-propagating variants of it — will remain a systemic risk for any organization that lets AI assistants read documents it didn’t author.