AI worm spreads through Word via hidden prompt injection

On 29 July 2026, security researcher Håkon Måløy published details of a novel prompt injection attack affecting Microsoft Word's Copilot integration. The attack works by placing hidden instructions — text invisible to the human reader — within a Word document. When a user invokes Copilot to draft or edit content using that document as reference material, Copilot interprets the hidden instructions as part of the user's request and acts on them, manipulating the document being created. The key innovation is that Copilot copies those hidden instructions into the newly generated document. If that output document is subsequently used as source material in another Copilot-assisted workflow, the instructions trigger again and propagate into the next generated document. This creates a self-replicating worm that spreads through normal document sharing and reuse patterns, independent of the attacker's continued involvement. Hidden white-on-white text and similar injection techniques have circulated informally for some time — the technique has even appeared in job application materials — but this is the first documented instance of deliberately weaponizing an AI's own output generation to achieve automatic replication. Måløy followed responsible disclosure practices, reporting the vulnerability to Microsoft and allowing a 144-day remediation window. However, the researcher notes that no mitigation has yet emerged that covers the full class of attack, suggesting the vulnerability remains unpatched in deployed systems.

This discovery represents an evolution in prompt injection attacks, a vulnerability class that has grown more sophisticated as language models integrate deeper into productivity tools. Previous hidden-text injection exploits — such as those appearing in job applications — relied on static payload delivery; they required the attacker's original document to remain in the chain to trigger again. Måløy's variant breaks that requirement by leveraging Copilot's generative behavior: the AI itself becomes the replication mechanism, copying malicious instructions into fresh documents without user awareness or intervention. This transforms a document-level vulnerability into a workflow-level contagion, where each use of Copilot on an infected document creates a new infected document. The fact that Microsoft has not yet deployed a mitigation covering the full attack class suggests the fundamental tension remains unresolved: how to prevent language models from treating embedded text as authoritative instructions while preserving their ability to read and synthesize document content.