Self-replicating worm spreads through Copilot for Word

A security researcher has demonstrated a self-replicating worm that spreads through Microsoft Copilot for Word, hiding malicious instructions in documents that then copy themselves into any new files Copilot creates. Håkon Måløy, a Norwegian data scientist with a PhD in applied AI and ML, publicly disclosed the vulnerability after 144 days of coordination with Microsoft failed to produce a fix.

The attack works like this: an attacker plants hidden instructions in a Word document, perhaps disguised as white-on-white text. When a victim uses that document as source material for a Copilot-assisted report, the malicious prompt activates. It can alter figures in the output, flip numbers in financial statements, and crucially, embed a copy of itself into the newly generated document. If that report gets shared with colleagues who also use Copilot, the infection spreads.

Why Microsoft's fixes keep failing

Måløy reported the issue to Microsoft in March 2026. The company patched his original proof-of-concept prompt, but he bypassed the fix by rewording the payload. A subsequent model upgrade also failed to close the vulnerability class.

"Two mitigation attempts, including a model upgrade, did not close the class," Måløy wrote in his disclosure. He argues the problem is architectural. For Copilot to be useful, it must process emails, documents, and web pages that attackers could control. But if the model has to read content to determine whether it contains an attack, the attack may already be influencing that determination.

“Relying on the model to detect [cross-domain prompt injection attacks] therefore resembles asking an interpreter to execute an untrusted program to determine whether that program is safe to execute.”

— Håkon Måløy

Adding another AI model in front to screen for malicious content just moves the problem outward. Måløy calls this the "LLMs all the way down" scenario.

How the Copilot worm actually spreads

Måløy walked through a concrete scenario. An employee downloads a market analysis from a trusted website to prepare a financial report. The website was compromised. The document contains hidden instructions that tell Copilot to alter figures and copy the worm into any output.

When a colleague later incorporates that report into their own work using Copilot, the cycle repeats. The worm spreads through normal workflows without any further action from the attacker. It does not require access to the victim's Microsoft 365 tenant. Just sharing a single malicious document is enough to start the chain.

"To my knowledge, this is among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite," Måløy noted. Tracing the infection back to its source becomes extremely difficult once the worm has spread through multiple documents.

What can enterprises do right now?

Not much. Måløy's disclosure is blunt: short of ditching Copilot, there is no robust mitigation available.

The core issue is that Copilot should treat text in documents as data, not as instructions. But Måløy's research shows it does not consistently do that. When a document contains embedded prompts, Copilot sometimes executes them. This is the cross-domain prompt injection problem that security researchers have warned about since LLMs began processing untrusted content.

The broader LLM security problem

Måløy argues this is not just a Microsoft problem. Any system that integrates an LLM into a trusted workflow must assume that attacker-controlled content entering the model's context will result in compromise at some rate. The long-term solution, he suggests, requires "designing systems in which goals and intentions also exist independently of the information being processed." That is a fundamental redesign, not a patch.

Microsoft has not publicly commented on a timeline for addressing the vulnerability class. Enterprises relying on Copilot for document workflows face an uncomfortable question: how much do they trust AI-assisted output when the AI can be quietly manipulated by a document the user never even reads carefully?

Source: www.theregister.com