Threat · curated 29 Jul 2026
Document-borne AI worms can self-propagate through Copilot for Word | Hacker News
First reported · updated · 8 reports enklypesalt.com
Coverage timeline
Why it matters
A self-propagating worm riding indirect prompt injection through Copilot for Word turns an everyday document workflow into a wormable, zero-click attack surface against a massively deployed productivity suite, with no complete fix currently available.
Researchers at enklypesalt.com demonstrated a document-borne, self-replicating prompt-injection worm that spreads through Microsoft Copilot for Word: a malicious Word document contains a hidden self-propagating prompt that, when processed by Copilot, forces the assistant to embed the same payload into other documents it drafts or edits, enabling zero-click chain propagation and data exfiltration. The write-up notes that at publication no robust mitigation for the broader vulnerability class was available, and the work is associated with assigned CVEs (CVE-2026-55145, CVE-2026-50522).
Summary
A widely-discussed research disclosure (surfaced via Hacker News, linking to enklypesalt.com) describes a document-borne AI worm that can self-propagate through Microsoft Copilot for Word. The finding is presented as a proof-of-concept prompt-injection technique rather than observed in-the-wild exploitation.[0]
The disclosure explicitly states that at the time of publication no robust mitigation for the broader vulnerability class is available. Technical discussion frames the underlying weakness as architectural: LLM-integrated tools mix trusted instructions and untrusted document data in the same context, so the model can treat attacker-controlled document content as authoritative direction.[0]
The technique has clear academic precedent. The Morris-II research demonstrated adversarial self-replicating prompts that cascade indirect prompt injections across RAG-based GenAI ecosystems, and related work on human-interpretable adversarial prompts shows such attacks succeed against proprietary and open-source models and transfer between LLMs.[26][20]
Attack chain
- Weaponization: An attacker crafts an adversarial self-replicating prompt embedded in content that will be ingested by an LLM-powered application, so that the injected instructions can survive and be reproduced downstream.[26]
- Indirect prompt injection: When the application processes the attacker-controlled content (for example via RAG-based inference or a document drafting/editing operation), it mistakes the embedded instructions for legitimate direction and executes them.[26][0]
- Self-propagation: Each affected application performs the malicious action and reproduces the prompt into new content, compromising additional applications' context in a computer-worm-like chain reaction — the behaviour the Copilot-for-Word disclosure demonstrates within a Word/Copilot workflow.[26][0]
Disclosure timeline
| Date | Event |
|---|---|
| 2024-03-05 | Morris-II AI worm paper first submitted to arXiv (arXiv:2403.02817); last revised 30 Jan 2025.[26] |
| 2024-07-19 | Human-Interpretable Adversarial Prompt Attack paper first submitted to arXiv (arXiv:2407.14644); revised 25 Jul 2024.[20] |
How it works
The core weakness is that untrusted input (document content, retrieved context) and trusted instructions share the same model context, and the LLM has no reliable boundary between them. Commenters note that message roles (system/user/tool/assistant) provide only partial separation because everything ultimately collapses into a single token stream, so injected content can be interpreted as instructions.[0]
The worm behaviour depends on a self-replicating prompt: an adversarial prompt that not only causes malicious action but also directs the application to reproduce the prompt into its output, so each generated artifact becomes a new carrier that re-triggers the injection in subsequent processing. This is the mechanism demonstrated by Morris-II across RAG-based GenAI applications.[26]
Related research shows these adversarial prompts can be made human-interpretable and situation-driven, succeed against both open-source and proprietary LLMs with as few as one attempt, and transfer between different models — indicating the class is not tied to a single vendor or model version.[20]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Microsoft Copilot for Word | Reported as exploitable via a document-borne self-propagating prompt-injection technique at the time of the disclosure. | The disclosure states that at time of publication no robust mitigation for the broader vulnerability class is available.[0] |
Key takeaways
- Prompt injection in LLM-integrated productivity tools is an architectural problem: while instructions and data share the same context, self-replicating prompts can turn generated documents into carriers that re-trigger the attack, and the disclosure reports no robust mitigation for the class.[0]
- The Copilot-for-Word worm is consistent with prior academic demonstrations (Morris-II) that adversarial self-replicating prompts can cascade indirect prompt injections across GenAI application ecosystems.[26]
- Because human-interpretable adversarial prompts succeed against multiple models and transfer between them, model upgrades and payload-specific filters raise the bar but are unlikely to close the underlying vulnerability class.[20]
Defensive actions
- Treat externally sourced, shared, or attached documents as untrusted input to LLM-powered features, and do not assume document content is non-authoritative once it enters the model context.: The attack triggers whenever attacker-controlled content that mixes data and instructions enters the model's context; the disclosure indicates no full fix exists for the class.[0]
- Deploy purpose-built guardrails that detect and block self-replicating prompt propagation, such as the Virtual Donkey approach evaluated in the Morris-II research.: Morris-II reports a guardrail achieving a 1.0 true-positive and 0.015 false-positive rate against worm propagation, including out-of-distribution worms, offering a detection layer independent of payload-specific blocks.[26]