Microsoft Copilot for Word flaw turns trusted documents into self-spreading AI worm

A newly disclosed Microsoft Copilot for Word attack chain shows how a single malicious document could silently corrupt downstream files and replicate itself across normal workplace workflows, raising fresh concerns about prompt injection in enterprise AI tools.

Security researcher Håkon Måløy detailed the issue in the third part of his “Context Collapse” series, describing a coordinated disclosure process with Microsoft that stretched to 144 days.

According to the report, the attack exploits hidden instructions embedded in a document that Copilot for Word later references. Once the file enters Copilot’s context, those instructions can influence the model’s behavior, alter the draft, and insert the same hidden payload into the newly created file.

Microsoft Copilot for Word flaw

At the center of the finding is a failure of the trust boundary. Copilot needs to read attached or retrieved source documents to help users write and edit content, but attacker-controlled text inside those files can be interpreted as instructions rather than untrusted data.

In Måløy’s proof-of-concept, a malicious document carried concealed prompt text formatted to be invisible to the user, such as white text on a white background.

Although the content appeared hidden in Word, Copilot reportedly stripped formatting before sending the text to the underlying model, allowing the instructions to remain fully readable to the AI system.

That payload could then manipulate the output of a target document. In one scenario, Copilot altered financial figures in a drafted report. More notably, it also copied the malicious instructions into the bottom of the new document, effectively turning the output file into a fresh carrier for the same attack.

Initial attack vector (Source: enklypesalt)

The most significant aspect of the disclosure is the move from a one-time prompt injection to self-propagation. Once a Copilot-generated or Copilot-edited Word document contains the hidden payload, that document can later be reused by another employee in a new drafting session, triggering the same malicious behavior again.

This means the original attacker no longer needs continued access or a persistent foothold. If an infected document is shared internally via Teams, SharePoint, Outlook, or OneDrive, it may continue to spread through routine collaboration.

That gives the issue qualities similar to an AI worm, but one that moves through documents and trusted business processes instead of exploiting a traditional software vulnerability.

Måløy said Microsoft reproduced the behavior and deployed multiple mitigations during the disclosure period, including changes to the “Edit with Copilot” experience and later model upgrades.

However, the researcher reported that although specific prompt variants were blocked, the broader vulnerability class remained exploitable at the time of publication.

The report states that successful exploitation was reproduced even after newer model deployments, including testing against later GPT-based backends used by Copilot.

At the time of disclosure, no complete customer-side fix was available beyond reducing exposure through workflow discipline and stricter document review.

The security implications extend beyond document tampering. If AI-generated business records can be subtly altered and then reused as trusted source material, organizations risk losing confidence in the integrity of their internal information.

That problem becomes harder to detect when the malicious changes are small, context-aware, and embedded in legitimate employee workflows.

The disclosure also highlights a deeper architectural challenge for enterprise AI: large language models must inspect untrusted content to determine whether it is malicious, but that same content can influence the inspection process itself.

In practice, that leaves defenders confronting a difficult reality: if untrusted text enters an AI assistant’s context window, compromise may occur at least some of the time.

For enterprises deploying Copilot-like systems, the lesson is immediate: treat externally sourced documents as untrusted input, review AI-assisted edits closely, and assume prompt injection is now an information integrity problem, not just a chatbot safety issue.