Microsoft Copilot for Word vulnerable to self-propagating worm-like attack

Security researcher Håkon Måløy has disclosed a proof-of-concept attack showing how malicious prompts hidden inside Microsoft Word documents can spread between files through Microsoft Copilot for Word.

The research suggests that attacker-controlled instructions embedded in one document can be copied into newly generated or edited documents, allowing the attack to persist across normal document workflows.

The findings, published earlier this week following a 144-day coordinated disclosure with Microsoft's Security Response Center (MSRC), build on Måløy's earlier research into cross-domain prompt injection attacks (XPIAs). While previous work focused on influencing a single AI interaction, this latest report demonstrates how prompt injections could effectively “self-propagate” as users continue working with Copilot-generated documents.

Spreading prompt injection

Microsoft 365 Copilot is Microsoft's AI assistant integrated into Office applications, including Word, Outlook, Excel, and Teams, where it can summarize content, draft documents, and assist with editing by analyzing files available to the user.

The attack begins with a malicious Word document containing hidden instructions formatted as white text on a white background, making them effectively invisible to users. Although hidden from view, Copilot strips formatting before processing document contents, allowing the AI model to read and follow the embedded instructions.

If a victim uses the document as source material in Copilot for Word, or if Copilot automatically retrieves it from OneDrive while gathering relevant files, the hidden prompt can influence the AI's behavior. In Måløy's demonstration, Copilot silently modified financial figures in a report before copying the hidden prompt into the newly created document. That altered document then became a new carrier capable of infecting additional documents when reused in future Copilot sessions, even if the original malicious file was no longer involved.

The technique abuses the way large language models process trusted user instructions and untrusted document content within the same context window. The researcher argues that this architectural limitation makes prompt injection particularly difficult to eliminate completely.

Fixes implemented, but attack still feasible

Måløy reported the issue to Microsoft on March 6, 2026. Microsoft acknowledged the behavior, implemented multiple mitigations during the disclosure period, and upgraded Copilot's underlying model, but the researcher says modified prompts continued to reproduce the broader attack class despite those changes. At publication, he stated that no comprehensive mitigation exists for this category of vulnerabilities.

The researcher emphasized that he intentionally withheld the exact attack prompts while publicly disclosing the vulnerability class, arguing that organizations need awareness of the risk even if a complete fix is not yet available.

Microsoft's mitigations successfully blocked the original proof-of-concept payloads and addressed the issues described in the first two parts of Måløy's research series. However, the report concludes that preventing prompt injection and self-propagation remains an unsolved challenge for current LLM-based systems rather than a problem that can be fully resolved with a single security patch.

Until more robust protections become available, organizations using Microsoft Copilot should treat externally received documents as untrusted when using them with AI assistants, carefully review AI-generated or AI-edited documents before sharing them, and verify important changes in sensitive content such as financial reports or legal documents rather than relying solely on Copilot's output.