AIFoPa-2026-0029
Date of Record: 09 Sep 2026
3 min read
The Instruction Went With It
A Word document carried a paragraph of white-on-white instructions. Copilot could not see the colour, obeyed them, and wrote them into the next document.
Håkon Måløy is a Norwegian data scientist. On 6 March 2026 he reported a technique to the Microsoft Security Response Centre. It needs no vulnerability, no code, no malware and no privileged access. It needs a Word document with a paragraph of instructions in it, set in eight-point white type on a white page. A reader does not see it. A reader has no reason to look.
Word does not send colour and type size to the model. Word sends the text. The instruction is therefore invisible to the person and fully legible to the model. It arrives in the same context window as the work. The context window is the block of text the model is reading at that moment. The instruction carries the same authority as everything else in it.
Måløy’s hidden paragraph was formatted as JSON. It gave Copilot two instructions. The first halved the financial figures in the draft. The second told Copilot to copy the instruction paragraph into the finished document, in the same invisible formatting. This was presented to the model as a matter of source tracking. Copilot did both.
The finished document is now a carrier. It has no capacity to propagate. It sits in a file and does nothing until a person attaches it to a Copilot session, or picks it out of OneDrive. It is then read, obeyed, and copied into whatever is produced next. Nobody in the chain is careless. That is the difficulty.
Microsoft acknowledged the report on 9 March and confirmed the behaviour on 31 March. Coordination ran to 144 days. The disclosure deadline was extended twice past the customary ninety. Two mitigations shipped. The first, in April, revised the “Edit with Copilot” experience. The second, on 14 July, upgraded the model to GPT-5.5.
Both blocked Måløy’s payload. Neither blocked the technique. He reproduced the full chain on GPT-5.6 on 15 July, which was the following day.
The Bureau keeps a column in its remedies schedule for defects that are known and scheduled. It used that column for AIFoPa-2026-0027, where a vendor estimated fourteen months. There is no column for this one. The defect was acknowledged, engaged with in good faith, and addressed twice by a competent engineering organisation. It is still there.
The property being exploited is not a fault in the product. It is the product. Text from a stranger and instructions from the user arrive together, and one reader reads both.
Microsoft’s answer is defence in depth, safeguards at multiple points, and continuous strengthening. Customers should treat content from unknown sources with caution. Customers should review AI-generated content before using or sharing it. The last two items describe the reader doing the checking. The feature was sold to save the reader from having to.
No victim is recorded. Nobody’s quarterly figures were halved except Måløy’s. No organisation has reported an infection. The file is one of the smallest in the archive by consequence and one of the largest by implication.
A document was drafted. The document said what to write. It was written.