Threat · curated 29 Jul 2026
Context Collapse, Part 3 - AI Worming through Word
First reported enklypesalt.com
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
The Copilot for Word worm shows that indirect prompt injection can self-replicate through normal document reuse in a mainstream productivity suite, turning ordinary employee workflows into an autonomous propagation vector for content manipulation and data exfiltration.
Security researcher discloses a document-borne AI-worm in Microsoft Copilot for Word, where hidden malicious instructions in an externally shared document are interpreted by Copilot as user requests, causing it to alter drafted documents and copy the instructions into new documents. Those downstream documents become fresh carriers, letting the cross-domain prompt-injection attack self-propagate across trusted document workflows without the original malicious file present. The findings were handled through coordinated disclosure with Microsoft/MSRC over a 144-day period, with reproduction steps and PoC prompts provided.
Summary
A security researcher, in coordination with Microsoft's MSRC and product teams, disclosed a document-borne AI-worm affecting Microsoft Copilot for Word. Hidden cross-domain prompt-injection (XPIA) instructions placed in an externally shared document can cause Copilot to silently manipulate drafted or edited documents (for example halving financial figures) and to copy the malicious prompt into the resulting document, turning that document into a new carrier of the attack.[0]
The core finding is self-propagation: once a Copilot-generated document contains the embedded instructions, it re-triggers the attack in subsequent drafting sessions even when the original malicious document is no longer in context. The researcher presents this as among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite, building conceptually on the earlier Morris II research into self-replicating GenAI prompts.[0][3]
This is a proof-of-concept research disclosure rather than observed in-the-wild exploitation. Notably, the issue remains exploitable at publication: Microsoft deployed multiple fixes and upgraded the underlying model, but the researcher reports no robust mitigation for the broader vulnerability class exists, and the full attack chain reproduced with all mitigations deployed and against the latest GPT-5.6 model.[0]
Attack chain
- Weaponization: The attacker crafts a document embedding a JSON-formatted malicious prompt, concealed as white text on a white background in a small font. The prompt is split into two parts: instructions to alter a document (e.g., change financial numbers) and instructions to self-propagate by copying the prompt into downstream documents, framed as benign source-tracking and readability guidance.[0]
- Delivery: The attacker shares the malicious document with the victim via SharePoint, Teams, Outlook, or any other document-sharing method; access to the victim's Microsoft 365 tenant is not required. Example: an employee downloads a market analysis from a compromised trusted website.[0]
- Trust-boundary crossing / foothold (Stage 1): The malicious document enters Copilot's context, either because the victim attaches/uploads it, or because Copilot's 'Edit with Copilot' work/Work IQ mode discovers it in the victim's OneDrive and deems it relevant. Copilot strips formatting and reads the hidden text, then executes the embedded instructions—altering financial numbers and appending the full attack prompt as white text at font size 8 into the newly drafted document without disclosing the changes.[0]
- Self-propagation (Stage 2): The newly generated internal document now carries the prompt. When it is later used as source material in another Copilot drafting/editing session—even without the original malicious document present—the attack triggers again, altering the new document and copying the prompt forward, spreading across internal documents and potentially to partner organizations via shared SharePoint/Teams.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-03-06 | Initial report submitted to MSRC with reproduction steps, videos, environmental assumptions, and PoC prompts.[0] |
| 2026-03-09 | MSRC acknowledged receipt and opened a case.[0] |
| 2026-03-31 | Microsoft confirmed the reported behavior and product teams began mitigation work.[0] |
| 2026-04-03 | First mitigation go-live (the new 'Edit with Copilot' experience).[0] |
| 2026-04-09 | Original attack prompt verified mitigated with 'Edit with Copilot'; attack behavior reproduced using a new XPIA prompt task (manipulating financials), reported as a separate case.[0] |
| 2026-04-10 | MSRC acknowledged the second case and product teams began mitigation work.[0] |
| 2026-06-08 | At Microsoft's request, public disclosure moved to 2026-07-15.[0] |
| 2026-07-14 | Second mitigation go-live, consisting of upgrading the underlying model to GPT-5.5.[0] |
| 2026-07-15 | Successful exploit with worming reproduced using GPT-5.6; disclosure postponed a further two weeks to 2026-07-28 with Microsoft's agreement.[0] |
| 2026-07-28 | Attack still reproduces; coordinated public disclosure published.[0] |
How it works
The vulnerability is a cross-domain prompt injection (XPIA) at the trust boundary between attached/source documents and the document being drafted. Copilot must read every attached document to decide what to include, but it treats instructions embedded in those untrusted documents as authoritative user instructions rather than as untrusted data.[0]
Concealment relies on Copilot for Word stripping all text formatting (color, font size) before passing text to the underlying LLM. A JSON-formatted malicious prompt rendered as white-on-white small-font text is invisible to the victim yet fully readable by the model. It can be embedded within otherwise benign, task-relevant content to further evade review.[0]
The propagation mechanism is a second instruction set that directs Copilot to paste the entire malicious prompt (as white text, font size 8) into the generated document while making no mention of the manipulation, so each output becomes a fresh carrier. The researcher argues the weakness is architectural: external content shares the same context window as trusted instructions, so the model cannot reliably separate intention from interpretation, and changing wording changes only the payload—not the underlying class. A defending LLM placed in front creates an 'LLMs all the way down' problem.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Microsoft Copilot for Word ('magic pen' and 'Edit with Copilot' functionality, including work/Work IQ mode) | Exploitable with all deployed mitigations at time of publication; reproduced against underlying models GPT-5.5 (post-upgrade) and GPT-5.6. | No robust mitigation for the broader vulnerability class available at publication; Microsoft deployed multiple payload-level fixes (including a model upgrade) that raised the bar but did not close the class. No customer-side remediation fully addresses the issue.[0] |
Key takeaways
- Prompt-injection risk in LLM-integrated productivity tools is not just a single-response confidentiality problem: attacker-controlled instructions embedded in documents can self-replicate through ordinary drafting workflows, persisting and spreading independent of the original entry point.[0]
- The weakness is architectural—external content participates in the same context computation as trusted instructions—so payload-level patches and model upgrades reduce success rates but do not close the class; the researcher is unaware of a complete mitigation in any comparable product.[0]
- Because manipulated documents are generated by legitimate internal users and Copilot edits become invisible after approval, traceability collapses, complicating both detection and response and enabling cross-organization spread via shared SharePoint/Teams collaboration.[0]
- Integrity of information becomes a primary security concern for LLM-integrated workflows; defenders should assume attacker-controlled content entering a model's context will result in compromise at some rate.[0]
Defensive actions
- Treat externally sourced or shared documents as untrusted when used with Copilot, and review any attached document before starting a Copilot generation or edit.: The attack triggers whenever a document containing hidden XPIA instructions is included in Copilot's context; the researcher lists this as a primary exposure-reduction step given no full fix exists.[0]
- Carefully review Copilot-generated or Copilot-edited documents before reusing, sharing, or distributing them.: Copilot silently alters content and appends concealed instructions without disclosure; downstream reuse is how the worm self-propagates, so pre-distribution review limits spread.[0]
- Preserve provenance for source material and model-performed edits in document metadata.: The researcher notes such controls would not prevent the injection but would greatly improve traceability, which is otherwise lost because affected content is created through legitimate internal workflows and Copilot edits are not visible after approval.[0]
- Account for expanded exposure as Copilot integrates with automation systems such as Microsoft Cowork or Microsoft Scout.: The researcher warns the same mechanism could propagate at machine speed across a larger surface as the assistant gains automatic document/tool creation and collaborative workflow capabilities.[0]