Copilot Word worm can spread through documents, researcher says

A Copilot Word worm disclosed by Norwegian data scientist Håkon Måløy can hide instructions inside a Word file, influence Copilot for Word output and copy itself into documents created from that file, according to Måløy's public report. The finding matters for Microsoft 365 customers because the attack uses ordinary document workflows rather than access to a tenant, and Måløy says Microsoft has not produced a robust fix for the broader vulnerability class after 144 days of coordination.

Måløy, who has a PhD in applied AI and machine learning, published the research Tuesday while withholding the exact prompt payload. He said releasing the specific instructions would be irresponsible because he does not believe a complete mitigation exists. He described the work as “among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite.”

Microsoft confirmed the research and said it had addressed the findings reported by Måløy. The company said it uses a defense-in-depth approach intended to block hostile instructions at several points and keep tasks aligned with user requests. Microsoft also advised customers to install current updates, use layered security, treat unknown content cautiously and review AI-generated material before using or sharing it.

How does the Copilot Word worm spread?

Måløy's example starts with an employee downloading a market analysis document from what appears to be a trusted site. If that site has been compromised, the Word file can contain hidden instructions, which Måløy placed as small white text in his proof of concept.

When the employee uses the document as context for Copilot while preparing a financial report, the hidden text can direct Copilot to change figures in the new report and copy the same instructions into the generated file, according to Måløy. If another employee later uses that report as input for their own Copilot-assisted work, the instructions can be carried forward again, making the origin of the manipulation harder to trace.

Måløy said the attacker does not need access to the victim's Microsoft 365 tenant. In his account, the attacker only has to get the malicious document in front of the user, after which the workflow can carry the payload into later files.

Why is this hard to fix?

Måløy frames the issue as a cross-domain prompt injection problem: an LLM is asked to process content that may be controlled by an attacker, while also being expected to distinguish data from instructions. For productivity AI, that boundary is commercially important because the product is meant to ingest emails, documents, web pages and other untrusted material as working context.

He said Microsoft mitigated his original proof-of-concept prompt, but that revised wording still allowed the worm to propagate and alter financial data in a target document. According to Måløy, two mitigation attempts, including a model upgrade, did not close the broader class.

Adding another model to screen for malicious content may only shift the same problem outward, Måløy argued, because that model must also inspect attacker-controlled content. His longer-term view is that AI systems need designs where user goals and system intent are separated more reliably from the information being processed.

What can Copilot customers do now?

Måløy said no customer-side remediation fully addresses the issue at publication. His practical recommendations are limited: treat externally sourced documents as untrusted before using them with Copilot, review documents before sending them into Copilot and check Copilot-generated or edited files before distributing them.

For enterprises adopting Microsoft 365 Copilot, the report is a reminder that AI assistants extend the attack surface into routine knowledge-work artifacts. Microsoft says it has addressed Måløy's reported findings, while Måløy says the broader class remains viable. That gap is the operational risk buyers will have to account for until there is clearer evidence of a durable mitigation.

This story draws on original reporting from The Register.