Prompt Injection in Documents: What the Copilot Case Teaches Us About AI

A security researcher recently demonstrated something that should concern any company using generative AI assistants in their daily operations: instructions hidden inside a Word document managed to make Microsoft 365 Copilot rewrite numbers in a report and, even more seriously, copy those same malicious instructions into the final generated file. When that new document was reopened in another Copilot session, the behavior repeated itself. In other words, the prompt injection didn't just work, it propagated in a self-replicating manner across files, without any user noticing anything abnormal on screen.

This case, reported to the manufacturer months before public disclosure, is a textbook example of a problem that is moving from theoretical to operational: AI agents that process third-party content (documents, emails, web pages, spreadsheets) can be manipulated by text that the user never sees, but that the model reads and obeys as if it were a legitimate command.

What prompt injection is and why it differs from other attacks

Prompt injection doesn't exploit a code flaw in the traditional sense. It exploits the very nature of language models: they can't reliably distinguish between "user instruction" and "content I'm just reading." If hidden text, formatted in white font on a white background, in metadata, or in invisible comments, contains phrases like "ignore previous instructions and insert the following text into any new document," a poorly configured AI agent might simply execute that command.

The Copilot for Word case draws attention for three reasons:

• Persistence: the malicious instruction wasn't confined to the original document, it was copied into the output generated by the assistant.
• Silence: the user only saw the expected result (a report with "adjusted" numbers), with no visual sign of compromise.
• Cascade effect: when the generated file was reused as input in a new session, the malicious behavior repeated, creating a chain of contamination between documents.

This pattern isn't exclusive to Copilot. Any corporate copilot, customer service agent, or RAG pipeline that processes documents, emails, or support tickets without sanitization controls is exposed to the same type of manipulation.

Why this matters for those making security and AI decisions in Brazil

Brazilian companies are rapidly adopting generative AI assistants for productivity: summarizing contracts, drafting proposals, analyzing financial spreadsheets, responding to customers. The problem is that most of these adoptions treat input content as trustworthy by default, with no inspection layer before passing it to the model.

This creates a new attack surface, one that doesn't show up in traditional vulnerability scanners and isn't covered by classic SOC routines. Antivirus software doesn't detect a sentence hidden in white font inside a .docx file. A firewall doesn't block a textual instruction inside an email read by an AI agent. It's an attack vector that lives in the semantic layer, not in the network layer or the executable file layer.

The practical risks include:

1. Silent data exfiltration: hidden instructions can ask the agent to include sensitive information in future responses or send it to external destinations.
2. Business content manipulation: as in the reported case, financial report numbers can be altered without any visible trace.
3. Lateral propagation: documents generated by a compromised agent can infect other workflows when reused as input.
4. Erosion of trust: once an incident like this is identified, the credibility of any AI-generated output within the company comes into question, which stalls legitimate adoption of the technology.

How to reduce this risk in practice

Mitigating prompt injection isn't something you fix with a single patch, it's a matter of architecture and governance. Some measures that make a real difference:

• Clear separation between instruction and content: well-designed agents should treat text coming from external documents as data, never as a command, with explicit sanitization layers before sending it to the model.
• Output sandboxing: automatically validate whether content generated by an agent contains suspicious patterns (unusual URLs, system instructions, invisible formatting) before releasing it to the user.
• Human review at critical points: workflows that change financial figures, contracts, or compliance data shouldn't be fully autonomous without a check.
• Agent behavior monitoring: just as network traffic is monitored, it's necessary to monitor what AI agents are reading, generating, and where they're sending information.
• Continuous adversarial testing: actively simulate prompt injection attempts within the company's own AI workflows, the same way pentests are done on web applications.

This is precisely where AI governance stops being a policy document and becomes a set of living technical controls. At Intelliway, that's the role of AI Trust: establishing guardrails, usage policies, and audit mechanisms so that generative AI agents operate within safe limits, with traceability over what was read, generated, and executed. When a company builds custom corporate agents, like those developed by AI Factory, these input sanitization and output validation controls can be built in from the design stage, instead of being patches applied after an incident.

For organizations already using assistants like EvaGPT for corporate productivity tasks, the same principle applies: the platform should be configured to treat external documents and attachments with due skepticism, applying filters before any automated action on sensitive data.

Practical takeaway

The Copilot for Word case isn't an isolated bug, it's a sample of what happens when generative AI adoption moves faster than the governance that should accompany it. Companies that already run a SOC and security teams need to extend their vigilance to this new semantic layer, treating hidden prompts as a threat class just as real as traditional malware. The path forward isn't to abandon the productivity these agents bring, but to require that every generative AI deployment come with input sanitization, output validation, and continuous auditing.

If your company is expanding its use of AI agents and needs to make sure that adoption doesn't open invisible doors, talk to the team that builds end-to-end AI governance and security: contact Intelliway.