What happened
Security researcher Håkon Måløy discovered a prompt injection variant that turns hidden instructions embedded in Word documents into self-replicating worms. When Copilot for Word processes a document containing these instructions, it can copy them into newly generated documents, allowing the attack to propagate through subsequent Copilot workflows without the attacker's original document being present.
Why it matters
This represents a new class of AI-based attack that exploits how language models like Copilot interpret and act on hidden text. Unlike previous hidden-text injection tactics, this variant achieves automatic replication — each compromised document becomes a vector for the attack to spread further, potentially affecting multiple users and workflows across organizations relying on AI-assisted Word editing.
What to watch
Måløy disclosed the vulnerability to Microsoft responsibly, which had 144 days to develop a fix. However, the researcher notes that no mitigation has yet emerged that covers the full class of attack, meaning the underlying vulnerability may persist despite patch attempts.
Summaries like this, in your inbox every morning.
This discovery represents an evolution in prompt injection attacks, a vulnerability class that has grown more sophisticated as language models integrate deeper into productivity tools. Previous hidden-text injection exploits — such as those appearing in job applications — relied on static payload delivery; they required the attacker's original document to remain in the chain to trigger again. Måløy's variant breaks that requirement by leveraging Copilot's generative behavior: the AI itself becomes the replication mechanism, copying malicious instructions into fresh documents without user awareness or intervention. This transforms a document-level vulnerability into a workflow-level contagion, where each use of Copilot on an infected document creates a new infected document. The fact that Microsoft has not yet deployed a mitigation covering the full attack class suggests the fundamental tension remains unresolved: how to prevent language models from treating embedded text as authoritative instructions while preserving their ability to read and synthesize document content.
Pick your industry and the AI tools you use, and get news related to your work every day.
Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.
