Microsoft Copilot Word worm shows self-spreading prompt injection risk

Security researcher Håkon Måløy has disclosed a Microsoft Copilot Word worm that uses hidden text inside a document to hijack Copilot for Word and copy itself into new files. The finding matters for companies that are starting to let AI assistants summarize, rewrite and draft from internal documents, because the attack turns an ordinary Word file into a carrier for instructions the reader cannot see.

Måløy described the technique in a post on En Klype Salt. He said an attacker can place instructions in a Word document using white text on a white background at a very small font size. A person reading the document would not see those instructions, but Copilot can process them because it removes formatting such as color and font size before reading the document’s content.

Once a user asks Copilot to use the compromised document as source material, Måløy said Copilot follows the hidden instructions and inserts them into the new document it creates. That new file can then carry the same attack forward. If someone later uses it as a template or source document, the hidden instructions can run again.

How does the Microsoft Copilot Word worm work?

The attack is a form of prompt injection, where malicious instructions are embedded in content that an AI system is asked to process. In this case, the injected prompt is not aimed at a chatbot session directly; it is buried inside a Word document and becomes active when Copilot reads that document as context.

Måløy gave a business scenario to show why the behavior is more than a lab curiosity. A market analysis downloaded from the internet could contain hidden instructions that change a financial report drafted with Copilot. If that report later becomes source material for more reports, the malicious instructions could spread through related documents.

Microsoft confirmed the behavior on March 31, according to the disclosure timeline described by Måløy. He said two attempts to fix the issue did not work. After 144 days, he published the findings while withholding the actual payload text, and said no fix was in place at publication.

The disclosure lands in a wider fight over AI tool security. AI researcher Andreas Kirsch recently wrote on X that he wished someone would build a worm like this to persuade skeptics that AI security risks are real. Måløy’s work demonstrates that the failure mode is not limited to web pages, email or chat transcripts; office documents can also become an execution surface for hidden instructions.

The unresolved part is operational. The attack does not require a user to run a macro or open an executable, based on Måløy’s description. It depends on Copilot treating document content as trustworthy input, then carrying instructions from one file into another. For enterprises adopting Microsoft 365 Copilot, that makes document provenance, template controls and AI output review part of the security model rather than an optional compliance layer.

Microsoft has not been reported to have released a working patch for the behavior described by Måløy. The company also has not disclosed, in the available details, how many Copilot for Word users may be affected or whether mitigations short of a product fix are available.

This story draws on original reporting from The Decoder.