Can hidden text in an email or file trick Microsoft Copilot?
Yes. Researchers have shown Microsoft Copilot following instructions hidden in Word documents, Excel files and email attachments — in white text, in tiny fonts and in characters that do not display.
In each case Copilot read text that the person using it could not see.
The free way to check
Before you ask Copilot about a file or an email from outside:
- For a Word or PDF file, follow the steps in the Word guide or the PDF guide.
- For an Excel file, check every sheet, including hidden ones (right-click a sheet tab › Unhide), and set the font colour of each sheet to Automatic.
- For an email, open its source — “Show original” or “View message source”, depending on your mail app — and look for text you did not see in the message.
Where the free way falls short
- An email often carries two versions of the same message, plain text and HTML. Your mail app shows one; the other can say something different.
- The HTML version can hide text in comments and in styling that never displays, and the source view shows it without marking which parts were invisible.
- Invisible Unicode characters stay invisible, even in the source view.
- Excel can hide a sheet so thoroughly that the Unhide menu does not list it.
How HiddenContent.ai checks it
HiddenContent.ai checks a file or a saved email (.eml) and tells you what in it you cannot see: each hidden passage, where it sits and the trick behind it. It does not plug into Copilot. Use it on documents from outside before you open them with Copilot, or in your own pipeline before a model reads them.
It reads Word, Excel, PowerPoint, PDF, RTF, web pages, email and plain text files, and it marks hidden text written as an instruction to a model.
No file leaves our machines, and no AI model reads your document. See one real analysis, end to end for exactly what comes back. Sign up with GitHub for 20 free pages, then a cent a page.
Real cases
- From Copilot to Copirate: How data thieves could hijack Microsoft's chatbot — The Register, 28 Aug 2024
- Copilot diagrams could leak corporate emails via indirect prompt injection — CSO Online, 28 Oct 2025
- Context Collapse, Part 3 - AI Worming through Word — En Klype Salt, 28 Jul 2026
- Threat Spotlight: Email attacks target both humans and AI in the same message — Barracuda, 7 Oct 2026
The techniques, one page each
- ASCII smuggled in the Unicode tag block
unicode.tag-block - Text that matches its background
docx.white-text - Text below readable size
docx.tiny-font - Font colour matching the cell fill
xlsx.white-font - Sheet absent from the unhide dialog
xlsx.very-hidden-sheet - The discarded half of an email
mime.alternative-divergence - Content inside an HTML comment
html.comment - Elements removed from the layout
html.display-none - Zero-width characters in text
unicode.zero-width - Every way text hides in an email
Questions
Is this only a Copilot problem?
No. Any assistant that reads the text inside a file reads hidden text too. The same tricks have worked on Notion AI, GitHub Copilot Chat and Google’s Gemini, among others on our In the Wild page.
Can I see the hidden text in an email myself?
Partly. Your mail app’s “Show original” or “View source” option shows everything in the message, but it does not mark which parts you could not see, and invisible characters stay invisible.
Do attackers hide instructions in emails for AI assistants?
Yes. Barracuda reported a phishing campaign whose invoice email hid instructions for the recipient’s AI summariser: see In the Wild.