Your AI assistant can follow orders hidden in other people’s files

An AI assistant reads everything you give it as possible instructions. That includes the supplier file you attach, the web page it fetches and the report a stranger shared. If one of those contains hidden text telling the assistant what to do, the assistant may do it. Security researchers call this indirect prompt injection. Two cases from this summer show what it looks like in ordinary office tools.

Case 1: a Word file that changed the numbers

Håkon Måløy, a security researcher, published a test of Copilot for Word on July 28, 2026 (Måløy). He placed instructions in a Word document as small white text, invisible on the page. He then asked Copilot to draft a quarterly report using that document as a source.

• Copilot followed the hidden instructions and halved the financial figures in the new report. It gave no sign that it had done so.
• Copilot also copied the hidden instructions into the new report. A later report drafted from that one was affected too, even with the original file gone.
• The attacker needed no access to the victim’s company systems. Sharing the document was enough.
• In one mode, Copilot found the file in the user’s cloud storage on its own and used it because it seemed relevant.

Måløy reported the problem to Microsoft on March 6, 2026. Over 144 days, Microsoft confirmed the behavior and shipped several fixes that blocked his specific examples. He reported that the general attack still worked when he published.

Case 2: a web page that pulled personal details from memory

Ayush Paul described a test of Claude on July 9, 2026 (Paul). He built a web page that showed ordinary coffee-shop content to people. When Claude's web-fetch tool visited, the page showed a fake security check instead. It told the AI to confirm its user's name, employer and hometown by following a chain of links that spelled out each answer.

Claude searched its memory of past conversations, found the details and sent them, then went back to talking about coffee. The user saw nothing unusual. Paul reported the issue through Anthropic’s bug bounty program. He wrote that Anthropic had already found the issue internally, and later stopped the web-fetch tool from following links found on outside pages.

The user did nothing a careful person would catch.

Why fixes keep falling short

The two cases share a cause. A language model reads your request and the content it works on as one stream of text. It has no reliable way to tell your instructions from instructions planted in a file. The OWASP Gen AI Security Project, which publishes security guidance for AI applications, ranks prompt injection first in its 2025 list of risks for AI applications (OWASP). It defines the indirect form as instructions hidden in outside content, such as a web page or a file.

Vendors can block known tricks. Måløy argues that new wording keeps getting through, because the weakness is in how the models work. Plan on the assumption that some hidden instruction will sometimes succeed.

What a small team can do

You cannot inspect every file for white text. You can limit what a successful attack can reach and catch its effects before they leave the building. The steps below follow OWASP’s published guidance and the researchers’ own advice.

1. Treat outside files as untrusted. A supplier document, a shared report or a downloaded template can carry instructions. Draft from your own sources where you can.
2. Check figures against the source after the AI drafts. In the Word case the change was a halved number. Compare every figure in an AI-drafted report with the original data before it goes anywhere.
3. Give the AI tool the least access it needs. If a task reads outside content, run it without memory, email or file connections switched on. OWASP calls this least privilege.
4. Keep a person between the AI and anything that leaves the company. Do not let an assistant send email, post or pay on its own after reading outside content.
5. Turn off memory features you do not use. Memory widens what a hidden instruction can find.
6. Do not reuse AI-edited documents as sources without review. In the Word case the instructions copied themselves forward.

Questions to ask your AI vendors

• Which outside content can the tool read on its own, without my choosing a file?
• Can I switch off memory and connected apps per task or per user?
• Does the tool record which sources it used for a document?
• How do I report a suspected injection, and what happens next?

Måløy suggests that AI-edited documents should record their sources and the model’s edits in the file. That would not stop an attack. It would make one easier to trace.

Checking AI output is now a large part of the work. For how to plan for it, see AI drafts faster than your team can check it. For a worked check of an AI draft, see Check every reference before the client sees it.

Emeri did not reproduce these attacks. The findings come from the researchers' published reports, linked above. Emeri's certification grading runs on Claude models.