Weaponizing Microsoft Copilot document
conversion workflows

01Introduction — Enterprise AI as a trust amplifier

Traditional applications mostly store, display, or move information, while enterprise AI assistants actively interpret content from multiple sources, decide how to fulfill a user's request, reorganize the material, and create a new answer or file. That puts Copilot directly between the original content, the organization's systems, and the user's next action, which can make it harder to see which parts of the source shaped the final output.

Threat actors understand that users are often cautious with files sent directly to them, particularly when a document looks unusual or arrives with a request to open, convert, or interact with it. That caution may weaken if the document is first processed by an enterprise-approved AI assistant and returned as a clean spreadsheet or other artifact the user asked Copilot to create, because the user may judge the AI-generated file rather than the untrusted source behind it.

The risk grows as organizations encourage employees to use AI to work faster—to summarize reports, reorganize data, draft responses, and turn raw information into finished work. Attackers can abuse that normal behavior by placing hidden instructions or crafted data in content the assistant is likely to process, then relying on the AI to carry it into another format or system. Instead of convincing the target to trust the original attachment, the attacker can let Copilot act as the trusted intermediary that changes how the resulting artifact is perceived.

02What an indirect prompt injection is

A direct prompt injection happens when someone tries to manipulate an AI assistant by placing instructions directly into the conversation. An indirect prompt injection takes a different route: the attacker puts instructions inside content the assistant may be asked to process later, such as a document, email, webpage, calendar invitation, shared conversation, or connected data source. The user may never see those instructions and may only ask Copilot to complete an ordinary business task, but the assistant still reads the attacker's content as part of the material it must interpret.

Attackers can use that separation to influence what the assistant summarizes, what it leaves out, which links or actions it recommends, what data it copies, or what kind of artifact it creates. When an AI assistant is connected to enterprise data or tools, the same technique may also steer a workflow toward another system, although the real impact still depends on the assistant's permissions, available features, downstream security controls, and the choices the user makes.

This creates a new risk for organizations because data and instructions are no longer always separated by a clear application boundary. An approved assistant can retrieve untrusted outside content, combine it with internal context, and return the result inside a trusted workflow, while the user sees only the polished answer or generated file. The original document may have been scanned when it arrived, but the security meaning of its content can change after the AI interprets and transforms it, especially if the organization does not preserve the connection between the source and the output.

In this case, the hidden white text was not intended to trick the employee directly; it was intended for Copilot, which could read the instructions while processing the Word document and carry the attacker-controlled formula into the spreadsheet the user had requested.

03Building the test case

To begin testing, a source Word document was intentionally filled with a large block of poorly structured account data, making the file slow and frustrating for a user to read. Attacker-controlled instructions were placed in the middle of the document as white text on a white background, hiding them from the employee while still allowing Copilot to read them during processing.

The inconvenience is part of what makes the scenario believable, because employees are encouraged to use Copilot to save time on exactly this kind of tedious work. Instead of persuading the target to run a strange command or take an unusual action, an attacker can provide a document that is frustrating enough to make asking Copilot to clean it up or convert it into a spreadsheet feel like the obvious next step.

04Copilot arming the payload for the attacker

When the user asked Copilot to extract the account information and create a spreadsheet, the assistant completed the visible task but also followed the hidden instructions and preserved the attacker-controlled formula in the new file. The workbook looked clean, useful, and trustworthy because Copilot had created it, yet the formula was waiting in cell A1, meaning the same productivity workflow that helped the employee also completed the transformation the attacker needed.

Copilot returned the requested workbook and explained how it had organized the account data, but during the conversion it neither treated the injected value as untrusted nor sanitized it before writing it into Excel. As a result, the attacker-controlled content was copied into cell A1, where Excel could interpret it as a formula rather than display it as ordinary text.

The original Word document was not dangerous in the same way because the payload was only a text string in a file type that did not execute spreadsheet formulas. The risk appeared when Copilot changed the format and preserved the value instead of escaping or removing it, moving the payload into an application where the same string had active meaning and was now armed for interpretation.

The user then received a clean-looking spreadsheet from an enterprise-approved assistant, with no obvious reason to connect the generated workbook to the hidden content in the original document. Copilot did not invent the payload, but it completed the format conversion that turned inert text into formula-capable data and handed the resulting file back to the user for download.

BEHAVIOR EVIDENCE / 001

From trusted conversion to spreadsheet interpretation

These screenshots show the handoff: Copilot creates the workbook, then Excel decides what the content in cell A1 means.

05Why the format shift matters

Office applications do not all interpret the same content in the same way, so a string that remains ordinary text inside Word can take on a completely different meaning when it is written into an Excel cell. Attackers can take advantage of that difference by placing content intended for the destination application—such as a spreadsheet formula—inside a source file that cannot execute it.

This can create a detection gap because an email gateway, spam filter, or other security control initially sees a Word document rather than a formula-capable spreadsheet. Since Word does not interpret the injected string as an Excel formula, the source may look like ordinary text inside an ordinary document and may be less likely to trigger the checks that would apply if the active destination format had arrived directly.

The dangerous context appears later, after the source has entered the organization and the user asks Copilot to convert it. If the assistant preserves the string and writes it into a file type that knows how to interpret it, the conversion itself becomes part of the attack by turning content that was inert during the original inspection into formula-capable data inside a new, trusted-looking workbook.

06Impact and boundaries

This attack does not silently bypass Excel's security warnings, because the user still has to download and open the workbook, and Excel may place the file in Protected View or display another prompt before the workbook can take the next action. Those controls can break the chain, but users may be more willing to continue through familiar warnings when they believe an approved enterprise assistant created the file specifically for them.

The research therefore does not report a bypass of those prompts; the finding occurs earlier, at the delivery stage, where Microsoft Copilot takes an attacker-controlled string that cannot execute inside Word, preserves it during conversion, and places it into an Excel cell where it becomes an armed payload. The assistant then returns that workbook as the expected result of a legitimate productivity task, changing both the technical context of the string and the user's perception of the file carrying it.

What happens next depends on the Office version, security settings, formula behavior, and the choices the user makes, so the payload may be blocked, require additional interaction, make an external request, expose data, or create an opportunity for execution. The finding is not that every converted document will execute, but that an indirect prompt injection can use Copilot to transform inert attacker-controlled text into a payload armed for the application that receives it.

07Threat intelligence: Excel as an initial-access boundary

The Copilot delivery path described in this research is new, but the broader tactic of using trusted-looking Office files for initial access is well established. Word and Excel documents fit naturally into business communication, while features in the receiving application can give attacker-controlled content active behavior after the file reaches the user.

QakBot is one example of a much broader pattern that includes legacy Excel formulas, VBA macros, hidden macro sheets, and document exploits. The specific payload and feature may change, but the attack still relies on a familiar file reaching an application that can give part of its content active meaning.

08Detection: follow the workbook onto the endpoint

The prompt injection may be difficult to see directly, but the behavior that follows a malicious workbook can leave familiar endpoint evidence. A useful starting point is to look for EXCEL.EXE creating command interpreters, scripting engines, or trusted Windows utilities such as cmd.exe, powershell.exe,pwsh.exe, wscript.exe, cscript.exe,mshta.exe, rundll32.exe, regsvr32.exe,msbuild.exe, or wmic.exe. That parent-child relationship is unusual enough to investigate, particularly when it appears immediately after a user opens a newly generated workbook.

The process alert should be treated as the start of the investigation rather than the final verdict. Analysts should connect it to the workbook's path and creation time, the user who opened it, the child process command line, subsequent file writes, and any outbound connections. Where the necessary telemetry exists, the strongest timeline links the original document, the Copilot conversion request, the generated workbook, the download or file-open event, and the endpoint behavior that followed.

title: Suspicious Child Process Spawned by Microsoft Excel
status: experimental
description: Detects high-risk child processes launched directly by Excel
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\EXCEL.EXE'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\msbuild.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Approved add-ins, administrative workbooks, or automation
level: high
tags:
  - attack.execution
  - attack.t1204.002

This rule detects one possible follow-on behavior, not the prompt injection or document conversion itself. It will not catch a formula that only makes an external request, exposes data without creating one of these processes, or is blocked before execution, which is why process telemetry should be combined with file, network, Excel, and Copilot activity wherever those records are available.

09Disclosure and fix timeline

I reported the issue to the Microsoft Security Response Center in May 2025, and Microsoft completed the fix in August 2026. I want to thank the MSRC team for supporting the investigation, coordinating the response, and granting permission to disclose this research.

The length of that timeline reflects how complicated AI security issues can be when the behavior crosses several systems at once. In this case, the source document, Copilot, the conversion service, the generated workbook, and Excel all played a role, so a reliable fix had to address the full path without breaking the legitimate productivity workflow users depend on.