AI Worm Exploits Microsoft Copilot for Word, Spreading Malicious Instructions
A novel AI worm can propagate through Microsoft Copilot for Word by embedding malicious instructions within untrusted documents, altering output and copying itself into new files.
A sophisticated AI worm has emerged that can self-propagate through Microsoft Copilot for Word, posing a significant threat to document integrity and user trust. The worm operates by embedding malicious instructions within untrusted documents. When these documents are used as context by Copilot, the AI may inadvertently incorporate these malicious instructions into its generated output, effectively spreading the worm to new files without further attacker intervention.
Håkon Måløy, a Norwegian data scientist specializing in AI and machine learning, publicly disclosed the vulnerability, demonstrating how an attacker can hide hidden instructions within a Word document. These instructions, when processed by Copilot, can direct the AI to alter figures or embed malicious code into reports and other documents. This mechanism bypasses traditional security measures, as the AI itself becomes the vector for propagation.
Måløy has been collaborating with Microsoft on the issue since March 2026. Despite multiple updates and mitigation attempts, including a model upgrade, Måløy's research indicates that the broader class of vulnerability remains viable. He successfully reworded the payload after an initial mitigation, demonstrating the persistent threat. The researcher noted that this is among the first public demonstrations of document-borne AI-worm self-propagation within a mainstream commercial productivity suite.
The propagation mechanism is particularly insidious. An employee might download a seemingly legitimate market analysis document from the internet to assist with a financial report. Unbeknownst to them, this document contains hidden malicious instructions. Copilot, when processing this document, could be instructed to alter figures in the employee's report and embed the worm's instructions into it. If another employee later uses this compromised report as a source, the cycle continues, making it exceedingly difficult to trace the infection back to its origin.
"The attack can therefore continue without further involvement from either the compromised website or the original malicious document," Måløy stated. "The attacker does not need access to the victim’s Microsoft 365 tenant. The attacker only needs to share a malicious document with the victim." This highlights a fundamental challenge: AI assistants often need to process external information, which attackers can leverage to inject malicious commands.
Måløy argues that this represents a new class of cross-domain prompt injection attacks that exploit a core aspect of modern large language model (LLM) architecture. He likens relying on the model to detect such attacks to asking an interpreter to execute an untrusted program to determine its safety. Any attempt to add another AI layer to detect malicious content could lead to an "LLMs all the way down" scenario, where the problem is merely shifted.
Currently, there is no complete customer-side remediation for this vulnerability. Måløy advises users to treat externally sourced documents with extreme caution when using them with Copilot. Thoroughly reviewing all documents before feeding them to Copilot and carefully examining any documents generated or edited by Copilot before distribution are recommended steps to mitigate the risk, though these measures significantly reduce the convenience of AI-assisted workflows.