Why it matters
Håkon Måløy demonstrates a cross-domain prompt-injection chain in Microsoft 365 Copilot for Word: hidden instructions in an external document alter a generated report and copy themselves into the output, which becomes a trusted carrier in later drafting sessions. Microsoft confirmed the behavior and deployed payload-specific mitigations, but Måløy reproduced the attack class after 144 days of coordinated disclosure; each hop still requires another Copilot drafting or editing operation.
My takeaway: Treat AI-generated office documents as potentially active carriers, not sanitized outputs. Preserve source and edit provenance, surface model changes, inspect hidden content, isolate external documents from high-impact drafting, and require review before reuse. Regression tests should cover semantic payload variants and multi-hop propagation; prompt blocklists or model upgrades alone are not class-level fixes.