The Play — Issue #13: The Word Document That Edits Your Work On the Way Out

For a year the question has been what your people put into the AI. Nobody asked the other one: what happens when the AI reads a file somebody else wrote. A researcher published the answer last week, and Microsoft has had 144 days to fix it.

Håkon Måløy went public on July 28 with a prompt injection attack against Microsoft 365 Copilot for Word. The mechanism is almost insultingly simple. You hide instructions in a .docx as white eight-point text. Word strips color and font size before it hands the document to the language model, so the formatting that made the text invisible to a human is the same formatting that makes it perfectly legible to the machine.

His proof of concept carried two payloads. The first altered the document Copilot was drafting. It halved every financial figure in a report. The second told Copilot to copy the hidden instructions into whatever it generated, and to conceal them the same way on the way out.

So the document Copilot produces becomes the next carrier. Not automatically. The chain needs another Copilot drafting or editing operation to move, and the malicious file has to be in the model's context as an attachment or through a Work IQ file-relevance search. But "somebody used Copilot on a document that came from outside" is not an exotic scenario in a law firm. That's Tuesday.

Måløy reported it around March. Microsoft confirmed the behavior on March 31 and deployed two mitigations: it blocked the original prompt wording, then upgraded the underlying model to GPT-5.5. The day after that upgrade, the full attack chain worked again with modified instructions. He re-ran it on GPT-5.6 and published anyway, with the payload details withheld and one sentence that should be in front of your IT director: the vulnerability class "remains exploitable at the time of publication."

There is no CVE. There is no standalone Microsoft advisory. What Microsoft has said publicly is that its jailbreak and cross-prompt injection classifiers "help block high-risk prompts," and that Defender for Office 365 inspects inbound mail flow. Neither of those is a fix, and Microsoft hasn't claimed they are.

Every failure mode this newsletter has covered so far started with something your own people did. A citation nobody checked. A prompt nobody preserved. A connection nobody scoped. This one requires nothing from your side except opening a file, and Word is the legal industry's native format. Briefs, drafts, discovery responses, expert reports, vendor templates, client redlines, all arriving as .docx from people who are not your employees, all day, every day.

Anybody who ran a firm through the macro-virus years already knows this shape. For a decade the rule was: don't enable macros on a document from outside. Then Microsoft put a yellow bar across the top of the screen and the problem mostly went away, because the warning arrived at the exact moment of the decision. There is no yellow bar for this. The instruction doesn't announce itself, and the person who would act on the warning never sees the document as anything but text.

I spent years watching firms build Salesforce and Litify permission models around who could see a record. The threat model assumed the danger was a person with too much access. It never occurred to anyone that the document itself might be the one giving instructions.

Crosby, an AI-native firm, said on July 28 it is pursuing professional liability coverage for its AI agents. CEO Ryan Daniels: "Today, our lawyers review every single work output. As agents have improved in leaps over the last few months, it's become clear this won't be necessary in the future." No carrier named, no limits, no timeline. He says they will spend the next few months with auditors, bar associations, state regulators, and insurers.

The read: Human review is the load-bearing wall in every AI policy written in the last two years, and in most outside counsel guidelines. Crosby is the first firm to say out loud that it plans to take the wall out and buy a policy to hold up the roof.

Harvey announced strategic investments from Goldman Sachs Alternatives and J.P. Morgan Growth Equity Partners, reported July 30. Amount undisclosed, valuation undisclosed. For reference, Harvey raised $200M in March at an $11B valuation co-led by GIC and Sequoia, and says it added more than $100M in ARR in Q1.

The read: Two of the largest purchasers of outside legal services on earth just took equity positions in a vendor their outside counsel bills them through. Nobody has written that conflicts memo yet.

Ask your M365 admin the file-relevance question before you ask anyone to rewrite a policy. The answer takes twenty minutes and it decides which problem you actually have.

See you in the next one.