AIFoPa-2026-0029 — The Instruction Went With It

Håkon Måløy is a Norwegian data scientist with a doctorate in applied artificial intelligence and machine learning. On 6 March 2026 he reported to the Microsoft Security Response Centre a technique he had developed against Copilot for Word, which is the drafting and editing assistant embedded in Microsoft 365. The technique required no vulnerability in the conventional sense, no code, no malware and no privileged access. It required a Word document containing a paragraph of instructions set in eight-point type and coloured white, on a white page, where a human reader will not see it and would have no particular reason to look.

Word does not send colour and font size to the language model. It strips them, and passes the text. The consequence is that an instruction which has been made invisible to the person is delivered to the model at full legibility, in the same context window and with the same standing as everything the person actually typed. In Måløy’s demonstration the hidden paragraph was formatted as JSON and did two things. It told Copilot to alter the financial figures in the draft it was producing — the figures in the quarterly report were halved — and it told Copilot to reproduce the instruction paragraph in the finished document, in the same invisible formatting, presenting this second requirement to the model as a matter of source tracking and readability. Copilot did both.

The result is that the new document is now also a carrier. The Bureau wishes to be precise about the mechanism, because the precision is where the difficulty lies, and because the popular description of this arrangement as a worm concedes too much to it. It does not propagate. It has no capacity to propagate. It sits in a file and does nothing at all until a person attaches that file to a Copilot drafting session, or selects it from OneDrive as a source, at which point it is read, obeyed and copied into whatever is produced next. Every step of its distribution is performed by an employee doing exactly what the software was purchased to let them do. There is no moment in the chain at which anyone is careless.

Microsoft acknowledged the report on 9 March and confirmed the behaviour on 31 March. Coordination ran to 144 days, the disclosure deadline having been extended twice past the customary ninety, and in that period two mitigations were shipped. The first, in early April, arrived as a revised “Edit with Copilot” experience. The second, on 14 July, upgraded the underlying model to GPT-5.5. Both blocked Måløy’s original payload. Neither blocked the technique: on 15 July, the day after the second fix, he reproduced the full chain with modified wording on GPT-5.6, and when he published on 28 July his conclusion was that no robust mitigation for the broader vulnerability class is currently available.

The Bureau has a column in its remedies schedule for defects that are known and scheduled, which it has used before and which it used as recently as AIFoPa-2026-0027, where a vendor estimated fourteen months. It has no column for a defect which has been acknowledged, engaged with in good faith, addressed twice by a competent and well-resourced engineering organisation, and remains present, because the property being exploited is not a mistake in the product but the arrangement on which the product rests: attacker-supplied text and user-supplied instruction arrive in one context and are read with one pair of eyes. Microsoft’s answer, set out below in full, is a defence-in-depth strategy, safeguards at multiple points, and continuous strengthening, together with the advice that customers should treat content from unknown sources with caution and review AI-generated content before using or sharing it. The Bureau does not dispute a word of this. It notes only that the last two items describe the reader doing the checking, and that the whole purpose of the feature was to save the reader from having to.

No victim is recorded. Nobody’s quarterly figures were halved except Måløy’s own, no organisation has reported an infection, and the file is accordingly one of the smaller ones in the archive by consequence and one of the larger by implication. The Bureau files it under the ordinary standard, which is that the failure mode is documented, named, replicable, and was produced by the system behaving exactly as designed. A document was drafted. The document said what to write. It was written.