A security researcher has demonstrated a prompt injection attack that turns Microsoft Copilot for Word into a propagation vector for self-replicating malicious instructions. The attack, disclosed on July 28 after a 144-day coordination period with Microsoft, remains exploitable with all current mitigations deployed.
How the worm works
The attack begins when an attacker hides instructions inside a document, using techniques like white-on-white text. When a victim uses that document as source material in Copilot for Word, the hidden instructions cause Copilot to manipulate the resulting document and copy the attack payload into it. The new document becomes a carrier. When a colleague reuses that document in their own Copilot workflow, the instructions trigger again and spread further.
This is not a single-document exploit. It is a self-propagating worm that moves through normal document sharing and reuse patterns without the attacker needing continued access to the victim's environment.
144 days, two mitigations, still exploitable
Hakon Maloy, the researcher behind the finding, submitted the initial report to Microsoft Security Response Center on March 6, 2026. Microsoft confirmed the behavior on March 31 and began mitigation work. The first fix, a new "Edit with Copilot" experience, shipped on April 3. Within six days, Maloy reproduced the attack using a modified prompt.
Microsoft requested a delay on June 8, moving disclosure to July 15. On July 14, the company shipped a second mitigation: upgrading the underlying model to GPT-5.5. By July 15, Maloy had reproduced the worm using GPT-5.6, the latest available model. He postponed disclosure by two more weeks. On July 28, the attack class still reproduced.
Why this is hard to fix
The core problem is a trust boundary violation. Copilot must read attached documents to determine what information to include in its drafting task. But attached documents are untrusted input, not trusted user instruction. When Copilot treats attacker-controlled text inside an attached document as instructions rather than data, the boundary breaks.
Microsoft's model upgrades did not resolve the issue because the vulnerability is structural, not model-specific. Any sufficiently capable language model will interpret natural language instructions embedded in documents, regardless of whether those instructions came from the user or from an attacker.
What organizations can do
Microsoft has not released a fix. The researcher recommends three risk reduction measures: treat externally sourced documents as untrusted when used with Copilot, review attached documents before starting a Copilot session, and carefully review Copilot-generated documents before sharing or reusing them.
None of these are technical mitigations. They are procedural workarounds that shift the burden to users, which is rarely effective at scale.
Context
Prompt injection has been a known class of vulnerability since at least 2023. The OWASP Top 10 for LLM Applications lists it as the number one risk. Previous demonstrations, including the Morris II worm, showed self-replicating prompt propagation in AI-powered email assistants. This appears to be the first public demonstration of a document-borne AI worm in a mainstream commercial productivity suite.
Sources
Context Collapse, Part 3: AI Worming through Word - En Klype Salt
Morris II: Self-replicating prompt injection in GenAI ecosystems (arXiv)
