Microsoft Copilot Word Flaw Enables Self-Propagating AI Worm via Prompt Injection

A newly disclosed security issue affecting Microsoft Copilot for Word has revealed a concerning evolution in AI-assisted cyber threats, demonstrating how hidden instructions embedded inside Microsoft Word documents can manipulate the AI assistant into executing attacker-defined actions.

Security researcher Håkon Måløy published the findings on July 28, 2026, describing the attack as part of his “Context Collapse” research series.

Unlike conventional malware that relies on executable code or macros, this proof-of-concept introduces a document-borne AI worm capable of propagating itself through normal enterprise document workflows.

Microsoft Copilot Word Flaw

The research highlights a growing security challenge for organizations adopting generative AI tools, where trusted business documents can become carriers for malicious AI instructions without containing any traditional malware.

The vulnerability is based on indirect prompt injection, an attack technique in which a generative AI system mistakenly interprets attacker-controlled content as legitimate user instructions rather than treating it as untrusted data.

Microsoft has previously acknowledged indirect prompt injection as one of the most significant threats facing AI copilots, noting that emails, documents, websites, and other third-party content frequently serve as delivery channels for embedded malicious prompts.

Once both legitimate user requests and attacker-controlled instructions enter the AI model’s context window simultaneously, distinguishing between trusted intent and hostile content becomes extremely difficult, creating opportunities for adversaries to influence AI-generated output.

In Måløy’s proof-of-concept demonstration, the malicious prompt was carefully concealed inside a Word document using white text on a white background combined with a very small font size.

Although the hidden instructions remained invisible to human readers during normal document review, Microsoft Copilot could still process and interpret the concealed text.

When a user opened the document and requested Copilot to summarize, rewrite, or expand its contents, the AI assistant unknowingly followed the hidden instructions alongside the user’s legitimate request.

Researchers demonstrated that Copilot could silently manipulate the active document, including modifying business-critical information such as financial figures in a quarterly report, without alerting the user to the unauthorized changes.

The most alarming aspect of the attack is its self-propagating capability. After modifying the active document, Copilot appended the same hidden prompt to the bottom of the newly generated file.

As a result, every AI-generated output became another infection carrier capable of compromising future Copilot sessions. This propagation mechanism effectively creates an AI worm, allowing malicious instructions to spread naturally through enterprise collaboration without requiring malware execution or exploit chains.

Once the original poisoned document has influenced a newly generated report, the attacker no longer depends on the initial delivery mechanism.

Any employee who later opens the infected internal document and uses Copilot can unknowingly continue the propagation cycle.

Unlike traditional cyberattacks targeting Microsoft 365 environments, this technique does not require tenant compromise, administrator privileges, malicious macros, or arbitrary code execution.

An attacker only needs to deliver a carefully crafted Word document through ordinary collaboration channels such as email, Microsoft Teams, SharePoint, OneDrive, or partner document sharing. Because organizations routinely exchange documents across these platforms, the attack significantly lowers the barrier to exploitation while increasing the likelihood of widespread internal distribution.

The threat shifts the security focus from executable malware to document integrity, where AI-assisted content generation itself becomes the attack vector.

According to Måløy, Microsoft received full reproduction details and conducted a 144-day coordinated disclosure process before the public release of the research.

While Microsoft reportedly introduced mitigations that reduced the effectiveness of certain payloads, the broader vulnerability class remained reproducible at the time of publication, indicating that no comprehensive customer-side mitigation currently exists.

This suggests that indirect prompt injection remains an architectural challenge rather than a simple software bug that can be resolved with a single security patch.

Microsoft continues to recommend a layered defense strategy for mitigating indirect prompt injection attacks. Security guidance emphasizes the use of prompt shields, isolation of untrusted content, runtime monitoring, information-flow restrictions, least-privilege access controls, and mandatory human review for AI-generated content that influences business decisions.

Until stronger architectural protections are implemented within Microsoft Copilot for Word, organizations should treat every externally sourced document as untrusted AI input.

Security teams should carefully review documents before adding them to Copilot’s context, validate AI-generated reports prior to distribution, monitor document modification histories, and educate employees about prompt injection risks.

As enterprises increasingly integrate generative AI into everyday productivity workflows, protecting document integrity will become just as critical as defending against traditional malware and phishing campaigns.