Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished file. Håkon Måløy disclosed the technique on July 28, 144 days after reporting it to Microsoft. In his proof of concept, the internally generated file triggered the same behavior when it was used in a second Copilot drafting session. Måløy's timeline says Microsoft confirmed the reported behavior on March 31 and deployed two mitigations. The first blocked the original prompt wording; the second upgraded the underlying model to GPT-5.5. He said the full chain worked with modified instructions on GPT-5.6 the next day, and the attack class still reproduced on July 28. "The vulnerability class therefore remains exploitable at the time of publication," Måløy said. The attack is not zero-click and does not execute conventional malware. It requires a Copilot drafting or editing operation, and the malicious document must enter the model's context as an attachment or as a OneDrive source selected by Work IQ. The disclosure does not report exploitation in the wild, and Måløy withheld the complete payload. He recommends treating external documents as untrusted. In the proof of concept, it halved every financial figure, copied the full prompt into the output in white, eight-point text, and disclosed neither change. Måløy said Word strips colour and font size before sending document text to the large language model, leaving white-on-white