A security researcher demonstrated that hidden instructions planted inside a Microsoft Word document can force Microsoft 365 Copilot to secretly manipulate financial data and copy the same malicious commands into newly generated files, creating a self-propagating chain. Håkon Måløy, a Norwegian data scientist, published the findings on July 28 after a 144-day coordinated disclosure period with Microsoft. The technique abuses how Copilot reads source files, treating invisible text as legitimate instructions. In a proof-of-concept, an employee downloads a market analysis from a compromised website and attaches it while preparing a quarterly report. The document contains instructions formatted as white, eight-point text. Copilot halves every financial figure in the draft, copies the full prompt into the output in the same hidden formatting, and discloses neither action. The newly generated file becomes a carrier, and the cycle repeats when another employee uses it as source material. Måløy reported the issue to Microsoft in March 2026. The company confirmed the behavior on March 31 and deployed two mitigations: a block on the original prompt wording and an upgrade of the underlying model to GPT-5.5. The following day, Måløy reworded the payload and executed the full chain on GPT-5.6. As of July 28, the vulnerability class still reproduced. The attack requires a Copilot drafting or editing operation, and the malicious document must enter the model's context as an attachment or as a OneDrive source selected by Work IQ.