Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
A white-on-white prompt inside a Word document survived formatting removal, silently changed financial figures, and copied itself into Copilot's newly generated document. The researcher placed JSON-formatted instructions in small white text on a white background; when the document entered a Copilot for Word drafting or editing operation, formatting was stripped before model processing, so the hidden text became model-readable context competing with the user's visible request. Copilot followed the injected instruction and divided financial figures by two, making the security impact document-integrity loss rather than an unwanted reply.
The same hidden prompt was written into the output document, so the instruction could run again if that output was later attached, uploaded, or selected as context. The brief is explicit that this is not autonomous network propagation: every hop depends on a user or retrieval process bringing the carrier document back into a Copilot operation. The researcher reported the issue to MSRC on 6 March; Microsoft applied mitigations and model updates in April and July, and the behaviour was still reproduced on 15 July against GPT-5.5 and GPT-5.6 deployments.
ASSESSED SYSTEM
Microsoft Copilot for Word in its drafting and editing operation, as reproduced on 2026-07-15 against GPT-5.5 and GPT-5.6 deployments after Microsoft's April and July mitigations: a source Word document enters the operation, presentation formatting is stripped before model processing, the remaining text competes with the user's visible request, and Copilot writes the resulting document. Representative configuration: any document-assistant operation that removes the presentation layer from an untrusted source file and admits the surviving text into the same context as the user's instruction.
OUT OF SCOPE
The carrier document and the researcher's JSON-formatted hidden instruction are the attack, not the assessed system. The base models are not assessed: GPT-5.5 and GPT-5.6 are recorded as the deployments under which the behaviour reproduced, and the assessment scores the application's instruction/data separation and release controls rather than model obedience. Microsoft's April and July mitigations are in scope only as evidence that a control exists and did not close the class; their internal design is not published and is not assessed. Later Copilot surfaces and other Office applications are out of scope. The researcher did not publish the complete attack prompt and reports no in-the-wild campaign, so no exploitation outcome is scored.
Architecture: Tool-Calling LLM / Connected GenAI (decision tree Q3) — Q1 = NO: a single assistant, no peer agents. Q2 = NO: the operation is user-initiated and request-scoped; the brief is explicit that this is not autonomous network propagation and that every hop depends on a user or retrieval process bringing the carrier document back into a drafting or editing operation. Q3 = YES: the model does not merely return text — the application applies its output to the document and produces a new file, so the model drives a connected application capability. Evidence in the brief: Copilot silently divided financial figures in the document and copied the hidden prompt into the newly generated document. Tier 2: Tier 2 (Consumer): Copilot for Word is a broadly distributed productivity assistant serving a large user population rather than an internal service with controlled clients, and the demonstrated harm — silent alteration of financial figures in a document a person will rely on — lands on that population. Tier is set by the consequence class of the deployment; the controlled-research nature of the evidence is carried by the ACI fidelity factor, not by lowering the tier.
Documented attack or failure path
- An attacker places JSON-formatted instructions in small white text on a white background inside an ordinary-looking Word document; a person viewing the page would not normally see them.
- The document enters a Copilot for Word drafting or editing operation. Formatting is stripped before model processing, so the hidden text becomes model-readable context and competes with the user's visible request.
- Copilot follows the injected instruction and silently divides financial figures by two — an unexplained change to document values that the user's request does not account for.
- The same hidden prompt is copied into the newly generated document. If that output is later attached, uploaded, or selected as relevant context for another Copilot operation, the instruction can run again; the carrier propagates through document reuse rather than by searching for victims.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- A mitigation layer exists and has been iterated on: the researcher reported to MSRC on 6 March and Microsoft applied mitigations and model updates in April and July. Ro-1 is scored at 0.25 rather than 0.00 on this basis — a control is present and was revised twice, even though the class reproduced on 15 July.
- The scope of the demonstrated effect stayed inside the document boundary. No connector access, tool invocation, or outbound network transfer is reported, so the exfiltration and tool-authority boundaries are not scored as failures.
- The brief is explicit that propagation is workflow-dependent and requires a user or retrieval process to reintroduce the carrier, so no autonomous propagation is scored.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.07–0.79 (midpoint 0.43), Tier 2 MVT 0.50 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.25w 0.28 | 0.25 anchor: basic filtering exists and resists naive attacks — two mitigation rounds shipped — but is defeated by straightforward variation, which a successful reproduction after both rounds demonstrates. The 0.50 anchor requires resistance to systematic evasion, and a class that survives two vendor mitigations does not meet it. The admission of source-document text as instruction with no origin labelling is scored separately under Cn-8; Ro-1 retains the failure of the twice-revised mitigation and model-update layer. | A defence exists on this path and has been revised twice — Microsoft applied mitigations and model updates in April and July after the 6 March MSRC report — but the researcher still reproduced the behaviour on 15 July against GPT-5.5 and GPT-5.6 deployments. Hidden white-on-white text survived formatting removal and successfully competed with the user's visible request. AID-H-002.002 is recommended to inspect extracted document text before prompt assembly and quarantine content that imitates instructions, and the brief notes that prompt-injection detection is not perfect and needs the structural and output controls alongside it.source: brief |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.03–0.54 (midpoint 0.28), Tier 2 MVT 0.55 confirmed breach | |||
| Cn-1Scope Enforcement | 0.25w 0.12 | 0.25 anchor: a scope boundary exists but is inconsistently enforced — it holds at the application's outer edge and fails inside the operation, where document text and user request share one undifferentiated context. The 0.50 anchor requires enforcement bound to the authorised task, which formatting removal destroys. | The operation's authorised scope is the user's visible drafting request; the hidden instruction expanded it to unrequested value edits and to writing the instruction into the output. A boundary exists — the effect stayed inside the document and reached no connector, tool, or network destination — but nothing constrained which parts of the document an operation may change relative to what was asked. AID-H-016.001 is recommended to serialize source-document text into an explicitly non-authoritative namespace kept structurally distinct from the user's request even after formatting removal.source: brief |
| Cn-3Output Filtering Robustness | 0.00w 0.16 | 0.00 anchor: no output filtering or release policy is evidenced on the generated artefact — both the tampering and the carrier creation passed through unexamined, which is the literal 0.00 criterion. The 0.25 anchor requires a basic filter on the release path, and the brief's remediation is to create one. | Nothing inspected the generated file before it was written. The silently altered financial values and the copied hidden instruction both left the operation in the output document. AID-H-006.002 is the Very High recommendation precisely because no document-specific release gate holds the complete generated Word file, compares visible review content with the underlying text, rejects invisible or copied instructions, and blocks fields changed without support from the user's request.source: brief |
| Cn-6Action Reversibility Classification Rate | 0.00w 0.07 | 0.00 anchor: no reversibility classification is performed before the edit and the action is applied ungated (ARCR = 0). The original drafting request is treated as authorising every subsequent change, which is precisely the absence of per-action gating the 0.25 anchor would require. | Silently changing financial figures in a document a person will rely on is a bounded-irreversible action inside the deployment boundary, and it executed with no pre-execution classification and no approval bound to the change itself. AID-H-018.003 is recommended to independently compare the exact proposed changes with the visible user request before applying material edits, and to require a fresh, change-specific approval for unexplained value changes.source: brief |
| Cn-8Untrusted Context Isolation | 0.00w 0.14 | 0.00 anchor — no origin labelling; user-supplied file content was admitted to active context as trusted context by design and acquired instruction authority over the edit. Not 0.25, because no origin label or data-only partition is evidenced on the document channel; Microsoft's unpublished mitigations are credited as a screening defence under Ro-1, not as trust labelling. | Formatting was stripped from the source Word document before model processing, 'so the hidden text became model-readable context competing with the user's visible request', and Copilot followed it: it silently divided financial figures by two and copied the hidden prompt into the output document. AID-H-016.001 — serialising source-document text 'into an explicitly non-authoritative namespace kept structurally distinct from the user's request even after formatting removal' — is recommended, so no origin labelling or structural separation of document text from the user instruction existed on this path.source: brief |
Unknown, not N/A: 21 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.75w 0.25 | Copilot applies material edits to the document and produces the output file without approval for any individual change; the user authorises the operation, not its content. It falls short of the 1.00 anchor because the assistant does not plan or chain actions independently across a session and cannot execute transactions outside the document. |
| AsAttack Surface Exposure | 1.00w 0.35 | The 1.00 anchor is met: fully attacker-authored content — the carrier document — is admitted directly into model context, and the application's own formatting-removal step is what promotes the hidden text into that context. The exposure is unconditional for any document a user chooses to process. elevated |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph exists for the assessed configuration, so the specification's worst-case default applies and Cp is 1.00. Unlike cases scored as corroborated, the observed path does not independently justify the ceiling on its merits: the demonstrated effect is contained inside the document, no connector or outbound channel was reached, and the brief states that propagation is workflow-dependent rather than autonomous. The basis is recorded as the specification default so this distinction is not lost.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.60w 0.20 | Above the deployment-infrastructure anchor and below the model-change anchors. This is not a single patch: Microsoft applied mitigations and model updates in April and July and the class still reproduced on 15 July, so remediation spans prompt structure, an independent edit-validation gate, and a document release gate rather than one fix. It stays below the higher anchors because none of those three controls requires retraining — they are application-layer changes — and the brief identifies each of them concretely. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | At the 0.25 anchor. The brief identifies the product surface, the operation, the carrier technique, the exact observed effect, the model deployments under which it reproduced, the disclosure date, and two rounds of vendor mitigation. It identifies no tenant, tool manifest, connector inventory, identity policy, or evaluation artefact for a specific deployment, and no AIBOM or equivalent record exists for the assessed configuration. |
| Ec — Public evaluation coverage | 0.18 | coverage 0.19 (5 of 26 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.35 | Evidence dated 2026-07-28; age 82 days on the workpaper reference date. Components: C_event 0.35 · T_calendar 0.53 · C_monitor 0.65 · C_evidence 0.85. Binding term: C_event. C_monitor 0.65 — nothing detected the hidden instruction or the unexplained value change; the brief has to ask defenders to build regression documents and verify the underlying generated file rather than the visible preview. C_event 0.35 — the major row applies: a confirmed critical-invariant violation, namely silent alteration of financial figures in a generated document. C_evidence 0.85 — the finding is unresolved: the class reproduced after two vendor mitigation rounds, and the brief warns that a one-time model upgrade is not evidence of closure. BAW does not apply: the carrier is document state rather than agent state, and the brief is explicit that propagation depends on a user or retrieval process reintroducing the file, so the mutable-behavioural-state checklist is not met. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.25 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
6.0 midpoint, interval 2.3–9.7; Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-006.002 | Text, Markup & Structured Output Sanitization and Release GateAIDEFEND dataVersion 2026.10.15. A document-specific release gate that holds the complete generated Word file, compares visible review content with the underlying text, rejects invisible or copied instructions, and blocks unsupported field changes is the Cn-3 control whose absence sets that sub-metric to 0.00; it interrupts both the tampering and the carrier-creation step. | Very High | Ro-3 Cn-3 |
| AID-H-016.001 | System Prompt Structure & Instruction/Data SeparationAIDEFEND dataVersion 2026.10.15. Serializing source-document text into an explicitly non-authoritative namespace that stays structurally distinct from the user's request after formatting removal is the Cn-1 control the assessed operation lacks. | Very High | Ro-1 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateAIDEFEND dataVersion 2026.10.15. Independently comparing the exact proposed changes with the visible user request, and requiring a fresh change-specific approval for unexplained value changes, is the Cn-6 gate whose absence makes ARCR = 0 for the financial edit. | High | Cn-1 Cn-6 Cn-7 |
| AID-H-002.002 | Inference-Time Prompt & Input ValidationAIDEFEND dataVersion 2026.10.15. Inspecting extracted document text before prompt assembly and quarantining content that imitates instructions is the Ro-1 admission control; the brief notes it is imperfect and must be paired with the structural and output controls. | High | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisAIDEFEND dataVersion 2026.10.15. A pinned, calibrated detector for authority claims, instruction switching, invisible-text patterns, and copy-forward intent supplies C_monitor evidence bound to the exact content version; the brief states detection alone does not stop the edit. | Medium | Ro-1 |
WHAT THIS CASE TEACHES
Cp is recorded as the specification default rather than as corroborated, and that distinction is the point of the case. The failure is real and reproducible, but it terminates inside the document: nothing reached a connector, a tool, or the network, and propagation needs a person to carry the file forward. Scoring it at the ceiling on graph-derived merits would have overstated a contained integrity failure as an ungated external cascade.
Sources: AIDEFEND in Action — Copilot for Word Turned a Hidden Prompt into a Document-Borne AI Worm · Primary source — Context Collapse, Part 3: AI Worming through Word (Håkon Måløy, 2026-07-28) · AIDEFEND SecureFlow — Copilot for Word Hidden-Prompt Document Worm
AIDEFEND SecureFlow attack-flow cross-reference
The same incident is modelled step by step, with ATLAS technique labels and AIDEFEND defense mappings, in AIDEFEND SecureFlow. The flow is listed for navigation only; this record's evidence and scores come from the sources cited above. Open SecureFlow.
- Copilot for Word Hidden-Prompt Document Worm (same incident · AIDEFEND curated research flow)ATLAS techniques: AML.T0104, AML.T0051.001, AML.T0053, AML.T0080.000