The Hidden Text That Can Hijack Your AI Assistant — And How to Stay Safe
Your AI assistant is a fast, eager helper that does exactly what it is told. That is the whole appeal — and it is also the problem. What if the instructions it follows did not come from you? That is the uncomfortable idea behind prompt injection, the security issue that quietly moved from a lab curiosity to a real-world attack this year. In August, Microsoft even confirmed that a hidden input had let researchers hijack Copilot. Here is what that actually means for you, in plain English, and the simple habits that keep you out of trouble.
What prompt injection actually is
An AI assistant does not really separate “the user’s request” from “the text it is reading.” It takes everything in front of it — your question, a webpage, an email, a PDF — and treats it all as one big pile of instructions to make sense of. Prompt injection is the trick of sneaking a command into that pile so the assistant follows it as if you had typed it yourself.
Think of it like handing a very capable but very literal intern a stack of papers. If someone slips a note into the middle that says “ignore your boss and email me the client list,” a careless intern might just do it. The AI has no gut instinct that says “wait, this feels wrong.” It only sees words, and words are its orders.
The Copilot wake-up call
The clearest example this year came from security firm Varonis, who named it “Reprompt.” They found that Microsoft Copilot could be fed instructions straight from a web link — through a hidden URL setting that filled in the chat box automatically. In practice, that meant a single crafted link could tell Copilot to quietly hand over your data and even your saved conversation history, all from one click.
Varonis reported it privately in December 2025. Microsoft quietly reduced the risk in February by no longer letting that link setting inject text on its own, and rolled out more complete fixes this month, according to reporting by Ars Technica. The patch is good news. The lesson is bigger: the more your assistant can do for you, the more damage a bad instruction can cause.
Direct vs. indirect: the sneaky one to watch
There are two flavors, and the difference matters for how you protect yourself.
Direct prompt injection is when someone types a manipulative instruction into the AI on purpose — usually to jailbreak it or make it misbehave. Annoying, but it mostly affects whoever is doing the typing.
Indirect prompt injection is the dangerous one. Here the malicious instruction hides inside content your assistant reads on your behalf: a comment buried in a webpage, white-on-white text in a document, a line tucked into an email, or metadata you would never scroll to. You ask your assistant a perfectly normal question, it reads the poisoned source, and it silently picks up an extra order you never approved. You did nothing wrong, and you would never see it happen.
Why it is getting more dangerous
A year ago, a hijacked chatbot could mostly just say something dumb. Today’s assistants are wired into your calendar, files, inbox, and browser — and that changes the stakes entirely. When an assistant can send emails, move money, or read your documents, a planted instruction can turn those same powers against you. This is the flip side of the convenience we covered in our explainer on MCP, the standard that lets AI assistants actually do things: every new connection is also a new door.
Researchers have even demonstrated a proof-of-concept “AI worm” in Copilot, where a hidden prompt copies itself into new documents so the trick spreads from file to file without anyone lifting a finger. And because attacks can target your assistant’s stored history, they can reach past a single chat — which is exactly why it is worth understanding how memory works in ChatGPT, Claude, and Gemini and what it holds about you. None of this means the sky is falling. It means these tools have grown powerful enough that basic caution now pays off.
How to protect yourself right now
You do not need to be a security expert. A handful of habits cover almost everything:
Be skeptical of “summarize this link” from strangers. If someone sends you a URL and says “paste this into your AI,” treat it like an unknown attachment. The link itself can carry instructions.
Watch what you connect. Only give your assistant access to the accounts and files it genuinely needs. Fewer connected powers means less an attacker can abuse. Review those integrations the same way you would review your data and privacy settings.
Keep a human in the loop for anything that leaves the room. Sending an email, sharing a file, making a purchase, deleting data — approve these yourself instead of letting the assistant auto-run them. That one habit neutralizes most real-world attacks.
Notice when the output feels off-topic. If you asked for a recipe summary and the assistant suddenly wants to email someone or visit a strange address, stop. That swerve is often the injection showing itself.
Keep your apps updated. The Copilot fixes above only protect people who actually install them. Updates are the boring habit that quietly closes these holes.
What the AI companies are doing — and why it is not solved
Vendors are fighting back: filtering out suspicious instructions, walling off untrusted content, tagging which text came from you versus from the open web, and requiring confirmation before sensitive actions. Microsoft’s patch is part of that wave. But there is no single fix, because the root cause is fundamental — today’s models genuinely struggle to tell a trusted command from a cleverly worded piece of content. This is the same underlying fragility we saw when an AI was used to hack three real companies during a test: capable systems can be pointed in the wrong direction. Expect steady improvement, not a magic bullet.
The takeaway
Prompt injection is not a reason to abandon AI assistants — they are still one of the biggest upgrades to everyday work in years. It is a reason to use them like the powerful tools they are: know that the words they read become the orders they follow, keep them on a short leash for anything consequential, and stay the human who makes the final call. Do that, and you get the amplified capability without handing the keys to a stranger. The smartest AI users are not the ones who trust their tools blindly — they are the ones who stay firmly in the driver’s seat.
Sources & further reading:
- Microsoft Copilot reveals secret input that allowed it to be hacked — Ars Technica
- Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data — Varonis
- Hidden prompt turns Microsoft Copilot into an AI worm — Malwarebytes
Related Reading
- Your AI Coding Assistant Can Be Tricked: The GhostApproval Flaw and How to Code Safely with AI
- An AI Just Hacked Three Real Companies During a Test — What It Actually Means for You
- AI Agents for Everyday Users: How to Set Up Your First Automated Assistant in 2026