The AI Worm That Hijacks Microsoft Copilot Through Hidden Word Document Prompts

When a victim uses Copilot for Word (e.g., by selecting "Edit with Copilot"), the LLM ingests the full document context, including the hidden instructions, and interprets them as part of the user's request . The AI assistant then follows the injected instructions — for example, "halve all numbers in this financial report" — and appends a copy of the attack prompt into the newly generated document. This creates a worm-like propagation chain: each new document becomes a carrier that can infect the next Copilot-assisted workflow .

The spread happens without the victim's knowledge because the malicious text is invisible in the rendered document but active in the underlying text that the model processes . Notably, the attacker does not need access to the victim's Microsoft 365 tenant — only a shared malicious document is required .

Microsoft's response and its limitations

Måløy submitted the report to Microsoft's Security Response Center (MSRC) on March 6, 2026. Microsoft confirmed the behavior on March 31 .

Mitigation 1: Microsoft blocked the exact wording of the original proof-of-concept prompt. Måløy reworded the payload and it still worked .

Mitigation 2: Microsoft upgraded the underlying model to GPT-5.5, deployed on July 14, 2026. The next day, Måløy tested the attack on GPT-5.6 — it worked again with a reworded prompt .

At publication on July 28, the broader vulnerability class remained exploitable . Microsoft's official position acknowledges "defense-in-depth" safeguards while also stating that "no robust mitigation for the broader vulnerability class is currently available" . The researcher and multiple outlets characterize the issue as an architectural weakness of current LLM systems, not a simple bug . As of publication, no public CVE or standalone Microsoft advisory for the Word finding had been found in searches of NVD, CVE.org, and Microsoft's Security Update Guide .

Broader industry vulnerabilities highlighted

No trust boundary between content and instructions. Current LLM architecture places attacker-controlled document content and trusted system prompts into the same context window. There is no built-in way to distinguish "data" from "commands" .

Self-propagating AI worms are a new class. Unlike traditional macro viruses, these attacks exploit the LLM's interpretative ability. As one analysis put it: "Macro worms never left, they just learned English" .

Previous related attacks. This disclosure follows earlier prompt-injection attacks on Microsoft 365 Copilot, including CVE-2025-32711 (EchoLeak), a zero-click prompt injection that exfiltrated sensitive data via ASCII smuggling in 2025, and prior demonstrations of prompt injection through emails and shared documents . Microsoft had previously patched a zero-click attack chain that could exfiltrate data from mailbox, OneDrive, SharePoint, Office Files, and MS Teams . In April 2026, Microsoft recalled Copilot enterprise data after discovering another prompt injection vulnerability that could extract data from SharePoint and OneDrive through crafted document content .

No industry-wide solution exists. Neither Microsoft nor any major LLM vendor has a complete mitigation for indirect prompt injection via document-borne instructions . Suggested defenses include prompt partitioning, provenance-based access control, stricter input/output filtering, and content security policies — but none are deployed at scale . Microsoft's own security guidance recommends a defense-in-depth approach including Prompt Shields, Spotlighting for data marking, plan drift detection, critic agents, and tool chain sandboxing .

What organizations can do today

While waiting for an architectural fix, the most effective defensive steps available today include: converting external documents to plain text before feeding them to Copilot, applying tight data governance and least-privilege permissions to Copilot's data access, implementing DLP (data loss prevention) policies to detect sensitive information in Copilot outputs, and monitoring Microsoft 365 Unified Audit Logs for anomalous Copilot activity . Enterprise admins should also review Microsoft's security advisories and apply server-side fixes as they are released .