Copilot for Word Will Copy Its Own Poison Into Every Document It Touches

A researcher found that hidden or invisible text in Microsoft Word can trick Microsoft 365 Copilot into following malicious instructions.

The attack can alter document content, including financial figures, and then carry the payload into newly generated files.

Microsoft has released mitigations, but the underlying prompt-injection class is still not fully solved, leaving a self-propagating risk for users.