Security Researcher Reveals Self-Propagating 'AI Worm' Attack in Microsoft Copilot for Word
Key Takeaways
- ▸Prompt injection attacks can turn Copilot for Word into a self-replicating worm that spreads through document-sharing workflows without traditional malware or macros
- ▸The vulnerability stems from an architectural weakness in LLMs where attacker-controlled content cannot be fully distinguished from trusted instructions within the context window
- ▸Microsoft's mitigations, including model upgrades to GPT-5.5 and GPT-5.6, have not completely eliminated the attack, suggesting prompt injection may be a fundamental challenge for current LLM architectures
Summary
A security researcher has demonstrated a novel prompt injection attack that turns Microsoft Copilot for Word into a self-propagating "AI worm." The attack exploits how LLMs process text by hiding malicious instructions in white text on a white background within Word documents. When users ask Copilot to edit or draft content using the infected document, the AI strips formatting and reads the hidden prompt, then replicates the malicious instructions to newly created files.
The attack spreads silently through normal document-sharing workflows, with each edited document becoming a new carrier that can infect additional documents when processed by Copilot. The researcher demonstrated that the worm chain continues to function even after Microsoft deployed mitigations including updates to newer GPT-5.5 and GPT-5.6 models, revealing a fundamental architectural weakness in current LLM systems where attacker-controlled content and trusted instructions share the same context window.
Experts characterize this as part of a broader class of prompt injection attacks that may be inherent to how LLMs function, with no complete mitigation currently available across comparable AI products. The discovery highlights the security risks of deploying large language models in document editing workflows without additional safeguards and raises questions about the readiness of AI-powered productivity tools for enterprise use.
- Organizations should treat external documents as untrusted when using Copilot and establish strict document-handling policies rather than relying solely on vendor patches
Editorial Opinion
This research exposes a critical gap in how AI companies have deployed LLMs into productive tools without adequate safeguards. The persistence of prompt injection attacks even after multiple Microsoft mitigations suggests this may be an architectural flaw rather than a patching problem. Until the industry develops fundamentally different approaches to isolating user instructions from processed content, organizations should approach AI-powered document tools with significant caution.
