AI Worm Exploits Microsoft Copilot for Word, Spreading Malicious Instructions
A novel AI worm can propagate through Microsoft Copilot for Word by embedding malicious instructions within untrusted documents, altering output and copying itself into new files.
A sophisticated AI worm has emerged that can self-propagate through Microsoft Copilot for Word, posing a significant threat to document integrity and user trust. The worm operates by embedding malicious instructions within untrusted documents. When these documents are used as context by Copilot, the AI may inadvertently incorporate these malicious instructions into its generated output, effectively spreading the worm to new files without further attacker intervention.
Håkon Måløy, a Norwegian data scientist specializing in AI and machine learning, publicly disclosed the vulnerability, demonstrating how an attacker can hide hidden instructions within a Word document. These instructions, when processed by Copilot, can direct the AI to alter figures or embed malicious code into reports and other documents. This mechanism bypasses traditional security measures, as the AI itself becomes the vector for propagation.
Måløy has been collaborating with Microsoft on the issue since March 2026. Despite multiple updates and mitigation attempts, including a model upgrade, Måløy's research indicates that the broader class of vulnerability remains viable. He successfully reworded the payload after an initial mitigation, demonstrating the persistent threat. The researcher noted that this is among the first public demonstrations of document-borne AI-worm self-propagation within a mainstream commercial productivity suite.
The propagation mechanism is particularly insidious. An employee might download a seemingly legitimate market analysis document from the internet to assist with a financial report. Unbeknownst to them, this document contains hidden malicious instructions. Copilot, when processing this document, could be instructed to alter figures in the employee's report and embed the worm's instructions into it. If another employee later uses this compromised report as a source, the cycle continues, making it exceedingly difficult to trace the infection back to its origin.
"The attack can therefore continue without further involvement from either the compromised website or the original malicious document," Måløy stated. "The attacker does not need access to the victim’s Microsoft 365 tenant. The attacker only needs to share a malicious document with the victim." This highlights a fundamental challenge: AI assistants often need to process external information, which attackers can leverage to inject malicious commands.
Måløy argues that this represents a new class of cross-domain prompt injection attacks that exploit a core aspect of modern large language model (LLM) architecture. He likens relying on the model to detect such attacks to asking an interpreter to execute an untrusted program to determine its safety. Any attempt to add another AI layer to detect malicious content could lead to an "LLMs all the way down" scenario, where the problem is merely shifted.
Currently, there is no complete customer-side remediation for this vulnerability. Måløy advises users to treat externally sourced documents with extreme caution when using them with Copilot. Thoroughly reviewing all documents before feeding them to Copilot and carefully examining any documents generated or edited by Copilot before distribution are recommended steps to mitigate the risk, though these measures significantly reduce the convenience of AI-assisted workflows.
The new article from Cyber Security News provides further technical detail on the Microsoft Word Copilot vulnerability, explaining how attackers can embed malicious JSON prompts disguised as invisible text. It elaborates on the propagation mechanism, detailing how Copilot parses these hidden instructions, alters document content (e.g., financial figures), and then copies the malicious prompt into newly generated or edited documents, effectively creating a self-propagating AI worm. The report also notes that while Microsoft has implemented partial fixes, the broader vulnerability class remains exploitable, even against newer underlying models like GPT-5.6.
The researcher who disclosed this behavior, Håkon Måløy, reported that Microsoft deployed two mitigations, including an upgrade to GPT-5.5, but the attack class remained exploitable on GPT-5.6. Måløy's proof-of-concept demonstrated that the vulnerability persists even when the infected document is used in a subsequent Copilot drafting session, indicating a potential for wider propagation than initially understood.
This new report from Malwarebytes Labs details how the AI worm can persist even after Microsoft's deployment of newer GPT-5.5 and 5.6 models, highlighting a fundamental architectural weakness in current LLM systems where attacker-controlled content shares the same context window as trusted instructions. The article also provides detailed instructions for disabling Copilot within Word and Microsoft 365 settings to mitigate this specific threat.
The security researcher who demonstrated this AI worm attack also detailed specific mitigation steps for users and administrators. These include treating external documents with caution, reviewing them before using them as Copilot source material, and disabling Copilot in Word via File > Options > Copilot or File > Options > General settings. Further administrative controls can limit Copilot's visibility and cloud-assisted functionality within the Microsoft 365 Admin Center.