Custom XML data is non-visible information stored inside an Office document, including Word files. In the Office Open XML format, it can live in separate XML parts that are not shown in normal page view, so a document may look clean while still carrying extra machine-readable content.
In cyber security, this matters because hidden XML can preserve metadata, workflow data, or even instruction-like text that tools may process without a human noticing. Attackers can abuse that gap for indirect prompt injection, document tampering, or data smuggling, especially when files are passed into automated systems such as editors, scanners, or AI assistants. Defenders should treat custom XML as part of the file’s attack surface: inspect it, strip unneeded hidden content, and sanitize documents before sharing or reusing them in trusted workflows.