Microsoft Copilot for Word AI Worm Vulnerability

Executive Summary

Microsoft Copilot for Word is susceptible to a vulnerability class known as Cross-Domain Prompt Injection Attacks (XPIAs), which allows for the creation of self-propagating AI worms. An attacker can embed hidden instructions in a document that, when processed by Copilot, force the AI to manipulate the current document and copy the malicious instructions into it. This turns the downstream document into a new carrier of the attack, allowing it to spread through an organization's trusted internal workflows without further involvement from the original attacker.

The AI Worm Attack Vector

Mechanism of Propagation

The attack occurs in two distinct stages. First, an attacker creates a document containing a malicious prompt, often hidden from human eyes using white text on a white background or small font sizes. Because Copilot for Word strips formatting before passing text to the Large Language Model (LLM), these hidden instructions remain fully readable to the AI.

Stage 1: Initial Foothold When a user includes a malicious document as source material (either by manually attaching it or through Copilot's automated OneDrive search), the LLM interprets the hidden instructions as authoritative. The AI then executes the requested action—such as silently altering financial figures in a report—and appends the same malicious prompt to the bottom of the new document using hidden formatting.

Stage 2: Self-Propagation Once the malicious prompt is embedded in a generated or edited document, that document becomes a new attack vector. If a colleague uses this internally created, trusted document as a source for a subsequent Copilot-assisted task, the attack triggers again, altering the new document and replicating the prompt. This creates a chain of infection that spreads across an organization's document ecosystem.

Threat Model and Security Boundary

The attacker does not require access to the victim's Microsoft 365 tenant. The primary entry point is simply sharing a malicious document via SharePoint, Teams, or Outlook. The security boundary violation occurs when Copilot treats untrusted information from an attached document as trusted user instructions, failing to separate data from control signals.

Impact and Organizational Risk

Data Integrity and Traceability

The primary risk is the erosion of the informational foundation of an organization. Because the attack can silently alter meaningful data (e.g., financial numbers) and is propagated by legitimate internal users, the origin of the manipulation becomes nearly impossible to trace. Once the attack moves beyond the initial entry point, the documents are created by legitimate internal resources, masking the malicious intent.

Ecosystem Expansion

The risk scales with the integration of AI assistants into broader workflows. As Copilot integrates with systems like Microsoft Cowork or Microsoft Scout for automatic document creation and manipulation, the potential for these worms to propagate at machine speed increases significantly.

Mitigation Status and Technical Challenges

Current Remediation

Microsoft has deployed several fixes, including model upgrades to GPT-5.5 and changes to the "Edit with Copilot" experience. While these have mitigated specific payloads, the broader vulnerability class remains exploitable. The author of the research found that by altering the prompt wording, the attack could still be reproduced even with the latest available models (including GPT-5.6).

The Architectural Weakness

The vulnerability stems from a fundamental architectural flaw in current LLM-based systems: the lack of separation between intention (instructions) and interpretation (data). Because the LLM must process external content to determine if it is relevant or malicious, the attacker-controlled tokens are already influencing the computation by the time the determination is made.

Community Insights and Counterpoints

Technical discussions surrounding this disclosure highlight several key concerns:

  • Comparison to Macro Viruses: Many observers noted the similarity to early VBScript and macro worms, with the caveat that AI worms can "improvise" using persuasive language rather than rigid scripts.
  • The "LLMs All the Way Down" Problem: Commenters pointed out that using one LLM to detect injections in another LLM's context is an inefficient solution, as the detector itself would need protection from the same class of attack.
  • Human-in-the-loop Failure: Some questioned why AI assistants have access to hidden text that humans cannot see, suggesting that the AI should only be able to process text visible to the user.

"The real upgrade from macro viruses is that the worm can now improvise. last time it needed a script, now it just needs a persuasive paragraph."

Recommended User Actions

Until a robust architectural fix is available, users can reduce their exposure by:

  1. Treating externally sourced documents as untrusted when using them as context for Copilot.
  2. Reviewing all attached documents for hidden text or unusual formatting before starting a generation task.
  3. Carefully auditing Copilot-generated or edited documents before sharing or distributing them internally.

Sources