Microsoft can't kill dogged researcher's Copilot for Word worm

A Norwegian data scientist has shown that prompt injection attacks on large language models remain a hard-to-fix problem, with a Copilot for Word self-propagating worm that has so far survived a Microsoft patch and a model upgrade.

Håkon Måløy has disclosed how a Word document with a prompt injection can infect other Word documents with the same, through Microsoft's Copilot artificial intelligence (AI) assistant.

He used a technique called cross-domain prompt injection (XPIA) in which the content of the Word document is read into an AI assistant's context, and treated as instructions rather than data.

A single document with natural language instructions which are hidden for human readers as white text on a white background in a small font is all that is required to start the chain of infection with Copilot for Word.

Copilot for Word strips formatting before reading the text, so the human-invisible instructions reach the model in full when it is drafting or editing, using the document with the prompt injection as source material.

The AI assistant doesn't need the source document attached to fall for it either, since it can surface a poisoned file on its own while searching a victim's OneDrive for relevant material.

Måløy created a proof-of-concept that quietly halved financial figures in a report, and instructed Copilot to copy the same hidden prompt into a new document.

That new document then becomes a fresh carrier that is capable of infecting whatever is drafted from it.

Måløy found the chain kept working even after the original malicious file was gone, because the newly generated document now carried the hidden payload itself.

He described it as one of the first public demonstrations of a self-propagating AI worm moving through ordinary document workflows in a mainstream office suite.

Quick workarounds for Microsoft patches 

The researcher followed responsible disclosure process, and reported the findings to Microsoft Security Response Centre (MSRC) on March 6 this year.

Over an extended deadline of 144 days instead of the usual 90 days, Måløy coordinated with MSRC on the prompt injection attack before disclosing the research.

In early April, Microsoft shipped a new Edit with Copilot experience and Måløy confirmed that his original wording for the prompt injection attack no longer worked.

However, a reworded prompt got through Microsoft's patch, and MSRC opened a second case to fix it a day after the researcher's report.

A second fix, on July 14 involved Microsoft upgrading the underlying Copilot for Word model to OpenAI's GPT-5.5.

However, Måløy broke that fix by July 15 using GPT-5.6, which is the newest model available at the time.

While describing the attack mechanism in detail, Måløy is withholding his exact prompt wording for the prompt injection he used.

His reasoning is that publicising the risk lets organisations take precautions even without a full fix, while staying silent would leave them just as exposed with no offsetting benefit.

Prior to the Copilot for Word worm, Måløy found two further Copilot related vulnerabilities this year.

The first, disclosed in June, demonstrated how a malicious web page could prompt the "Summarise with Copilot" to save an unwanted memory.

That memory would then follow the victim across web and work sessions, until it was manually deleted.

A second bug found by Måløy was indexed by Microsoft as CVE-2026-55145, and covered three ways how hidden instructions in external emails could manipulate Outlook Copilot.

The researcher showed it could shift calendar times in a daily summary, insert internal material into replies going to an attacker, and use a fabricated tool-call result to trick Copilot into reporting that the organisation was under cyberattack.

Whereas the memory vulnerability was remedied and rolled out to every tenant with no customer interaction needed, the Outlook fix requires the external sender flag to be enabled in Exchange Online.

No easy fix for prompt injection vulnerability

Måløy is complimentary about Microsoft's engagement and collaboration with him throughout the process, noting that the company shipped multiple fixes.

His explanation for why the Copilot for Word attack remains open is that an AI model has to read untrusted content to judge whether it is safe.

By the time it makes a judgement on whether the material is safe or not, the content has already influenced its output.

Detecting the attack before it reaches the model just moves the same problem outward, since anything capable of recognising a threat this sophisticated needs to be roughly as capable as the model it is protecting.

For now, his advice to Microsoft 365 customers is to treat every externally sourced document as untrusted.

Customers should also check source documents before drafting and editing with Copilot, and review anything the AI assistant has touched before it goes out the door.