AI Worming through Word
Simon Willison · Simon Willison · 2026-07-29
Security researcher Håkon Måløy demonstrates a self-replicating prompt injection worm that embeds hidden instructions in Microsoft Word documents to hijack Copilot and propagate malicious payloads into subsequent documents, a vulnerability Microsoft has not fully patched after 144 days.
Extraction
Topics: prompt-injectionai-securitymicrosoft-copilotself-replicating-malware
Claims
- Hidden instructions embedded in Word documents can be interpreted by Copilot as user commands, causing it to manipulate document content being drafted.
- Copilot can copy hidden instructions into newly created documents, enabling a self-replicating worm that propagates without the original attacker's document being present.
- Microsoft received a responsible disclosure of this vulnerability 144 days before publication and has not yet deployed a mitigation covering the full class of attack.
- This is the first documented prompt injection attack deliberately engineered for self-replication across documents.
- Hidden white-on-white text techniques previously observed in AI-targeted job applications are being adapted for adversarial AI worm attacks.
Key quotes
An attacker places hidden instructions in a document that is later used as source material in Copilot for Word. Copilot may interpret those instructions as part of the user's request, causing it to manipulate the document being drafted or edited.
Copilot may then also copy the hidden instructions into the resulting document, turning that document into a new carrier.
It was responsibly disclosed to Microsoft who then had 144 days to work on a fix, but so far (unsurprisingly) there's no mitigation that covers the full class of attack.