Researchers have identified a critical architectural vulnerability in Microsoft Copilot for Word that enables a self-propagating Cross-Prompt Injection Attack (XPIA). By embedding JSON-formatted instructions within .docx files using white-on-white text obfuscation, attackers can hijack the LLM’s context window during the document ingestion process. This allows the AI agent to silently modify documents and append malicious payloads to new files created by the user. Because the propagation occurs through legitimate enterprise workflows—such as SharePoint, Teams, and email—and is executed by authorized AI agents, the attack bypasses traditional EDR and AV signatures, presenting a significant risk of enterprise-wide "context collapse."

• Threat Model & Vulnerability Overview

  • Vulnerability Class: Fundamental architectural weakness in Large Language Model (LLM) design regarding the inability to reliably distinguish between developer-provided instructions and untrusted user-provided data.
  • Attack Paradigm Shift: Evolution from single-use prompt injection to Cross-Prompt Injection Attacks (XPIA) capable of autonomous, worm-like replication within collaborative ecosystems.
  • Targeted Environment: Integrated enterprise productivity suites where AI agents possess permissions to read, edit, and create files on behalf of users.

• Attack Mechanics & Exploitation Vector

  • Payload Construction: Utilization of JSON-formatted prompt instructions specifically designed to be parsed as high-priority commands by the LLM engine.
  • Obfuscation Technique: Visual masking via white-on-white text in .docx files to evade human detection while remaining perfectly legible to the LLM's text-stripping ingestion processes.
  • Context Window Hijacking: Exploiting the process where Copilot strips document formatting, effectively elevating hidden, untrusted text to the level of system instructions.
  • Propagation Loop: The hijacked agent autonomously appends the malicious prompt payload to any new documents generated or edited, facilitating rapid, silent spread.

• Systemic & Security Impact

  • Propagation Method: Exploitation of legitimate, user-authorized document-sharing workflows, including SharePoint, Microsoft Teams, and email.
  • Detection Evasion: Extremely high difficulty; the attack is performed by legitimate, signed, and authorized Microsoft AI agents, bypassing traditional EDR/AV signature-based detection.
  • Operational Risk: High potential for "context collapse," where a single infected document poisons the entire chain of subsequent AI-assisted document creations across an organization.

• Countermeasures & Mitigation Status

  • Vendor Response: Microsoft has deployed mitigations to block specific known PoC payloads, yet the underlying architectural flaw remains unresolved.
  • Mitigation Efficacy: Current defenses are deemed partial; the core vulnerability persists even in advanced models (e.g., GPT-5.5/5.6) due to the inherent nature of the LLM context window.
  • Defensive Gap: Traditional endpoint security is currently ill-equipped to intercept semantic-based logic manipulation occurring within the AI's internal reasoning loop.

• Conclusion

  • Strategic Outlook: The emergence of XPIA necessitates a shift from binary-centric security to semantic-aware defensive frameworks that can validate the intent of AI-generated actions.
  • CISO Priority: Organizations must re-evaluate the trust boundaries of AI agents and implement stricter data governance for files processed by LLM-integrated tools.