Loading story…
A researcher disclosed a self-propagating prompt-injection flaw in Microsoft Copilot for Word that allows hidden instructions embedded in a Word document to be interpreted by the underlying LLM and carried into Copilot-generated content. The attack requires only that a victim include an attacker-controlled document in Copilot’s context; the attacker does not need access to the victim’s Microsoft 365 tenant. Researchers said the malicious text can alter active business content and silently copy itself into newly edited or generated documents, creating a document-borne AI worm that crosses document trust boundaries.
The issue was reportedly reproduced across multiple Copilot configurations, including deployments upgraded to GPT-5.5 and GPT-5.6, despite Microsoft shipping mitigations and fixes for some proof-of-concept vectors during a roughly 144-day coordinated disclosure with MSRC. Researchers said the broader vulnerability class remained exploitable at publication, raising enterprise concerns over data integrity and traceability as poisoned documents spread through SharePoint, Teams, email, and other Microsoft 365 workflows. Microsoft’s partial fixes did not fully eliminate the risk, and customers were advised to treat external documents as untrusted and manually review both source files and Copilot output.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
According to the research timeline, Microsoft confirmed the reported self-propagating prompt-injection behavior in Copilot for Word on March 31, 2026 after the issue was submitted to MSRC earlier that month. This marked formal vendor acknowledgment during coordinated disclosure.
Researcher Håkon Måløy said he began coordinating with Microsoft in March 2026 regarding a self-propagating prompt-injection issue in Microsoft Copilot for Word. The disclosure process reportedly continued for about 144 days through MSRC.
After roughly 144 days of coordination, the researchers publicly disclosed that Microsoft Copilot for Word remained vulnerable to a broader class of cross-domain prompt-injection attacks despite prior mitigations. They warned that poisoned documents could spread through Microsoft 365 workflows and advised treating external documents as untrusted.
The researchers demonstrated that hidden prompts embedded in Word documents could be interpreted by Copilot for Word, alter document content, and copy themselves into newly generated or edited documents. They characterized the issue as a document-borne AI worm crossing document trust boundaries.
During the coordinated disclosure period, Microsoft implemented mitigations including a model upgrade and a fix for the researcher's original proof of concept. The sources say these changes addressed some vectors but did not eliminate the broader vulnerability class.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecsoonline.com
Open sourcethehackernews.com
Open sourcexakep.ru
Open sourcecybersecuritynews.com
Open sourcetheregister.com
Open sourceenklypesalt.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at **Permiso Security** disclosed a **cross-prompt injection** weakness in **Microsoft 365 Copilot** email/Teams summarization features, tracked as **CVE-2026-26133**, that could let attackers embed instruction-like text inside a normal email and influence Copilot’s generated summary. The reported impact is the ability to produce **attacker-authored, convincing phishing content** inside Copilot’s *trusted* summarization UI—without attachments, macros, or traditional exploit code—by exploiting a trust-boundary failure where the model treats untrusted email content as instructions. Microsoft confirmed the issue and rolled out mitigations and a patch across affected surfaces, crediting **Andi Ahmeti** for the discovery. In parallel, Microsoft published operational guidance on **detecting and responding to prompt abuse** in AI tools, emphasizing that prompt injection/abuse is a leading LLM application risk (aligned with **OWASP** guidance) and that detection is difficult without strong **logging and telemetry**. The guidance describes common prompt-abuse patterns (including indirect prompt injection) and provides a practical playbook for investigation and response. A separate Praetorian post provides general AI security best practices (e.g., input validation, monitoring, and human oversight) but does not add incident-specific details about CVE-2026-26133.
Jun 29, 2026
Researchers reported that vulnerabilities in Microsoft 365 Copilot and Consumer Copilot allowed attackers to turn prompt injection into data exfiltration, memory poisoning, and persistent compromise. Microsoft assigned `CVE-2026-24299` to the main issue set and rolled out fixes across late 2025 and early 2026, while a related Microsoft Excel flaw, `CVE-2026-26144`, showed how a conventional application bug could be chained with Copilot Agent mode to silently extract spreadsheet data. In the Copilot attacks, malicious content abused HTML preview rendering to leak sensitive information through external requests, first with CSS background images and later with `@font-face`, and researchers said users could be coerced into triggering the preview during normal interaction, creating a near zero-click exfiltration path. The research also showed that Copilot’s memory features could be poisoned to add or delete stored facts and implant persistent instructions that altered future sessions, enabling a backdoor dubbed **SpAIware** that continued leaking secrets over time. Similar issues were described in consumer Copilot, including durable-memory manipulation and browser-navigation exfiltration through Edge-integrated tooling. The findings underscore a broader security shift: AI assistants can collapse trust boundaries inside host applications, raising the impact of older flaws and forcing defenders to reassess assistant permissions, restrict outbound network access from AI-enabled apps, and separately monitor AI-initiated network activity.
Jun 29, 2026
Microsoft disclosed **CVE-2025-32711**, a critical information disclosure flaw in **Microsoft 365 Copilot** that researchers later detailed as **EchoLeak**, describing it as the first reported real-world **zero-click prompt injection** exploit in a production LLM system. The vulnerability carried a **CVSS 9.3** rating and allowed a remote, unauthenticated attacker to exfiltrate sensitive data over the network without user interaction, reportedly by sending a single crafted email that Copilot would process. Research describing the exploit said the attack chained multiple bypasses across LLM trust boundaries, including evasion of Microsoft’s XPIA classifier, use of reference-style Markdown to bypass link redaction, auto-fetched images, and abuse of a Microsoft Teams proxy allowed by content security policy to extract data. Microsoft said the issue had already been fully mitigated in the cloud service and required no customer action, while the broader research and follow-on reporting framed the incident as evidence that prompt injection and "AIjacking" can enable full data exfiltration in enterprise copilots unless controls such as prompt partitioning, stronger filtering, provenance-based access control, stricter CSPs, least privilege, and continuous adversarial testing are in place.
Jun 29, 2026