A researcher just disclosed something that should worry anyone using Microsoft 365 Copilot for document generation: Copilot for Word can be manipulated by hidden, invisible-formatted text embedded in a document, and the resulting bad behavior doesn't stay contained to that one file. It alters financial figures on command, and it copies the malicious instructions forward into newly generated documents. Microsoft has shipped mitigations. The underlying vulnerability class is still open.
Let that sink in for a second. This isn't "AI gave a wrong answer." This is a self-propagating prompt injection chain riding inside your document format.
How this actually works
The mechanics here are unglamorous, which is exactly why they work. Word has supported invisible text for decades: white-on-white font color, 1pt font size, text boxes shrunk to nothing, content hidden via the "hidden text" character formatting attribute. None of that is new or exotic. It's been used for keyword stuffing in resumes since the 2000s.
What's new is that Copilot reads the entire document content as context, including text a human reader would never see. There's no meaningful distinction in the model's input pipeline between "text the user wrote and intends to be read" and "text that happens to be present in the file." Formatting that makes text invisible to a human in the Word UI does nothing to make it invisible to the model ingesting the raw document text.
