---
title: "AI Prompt Injection Worm Targets Microsoft Word Copilot with Self-Replication"
source: "Simon Willison 博客（Atom）"
source_tier: "t2"
url: "https://simonwillison.net/2026/Jul/29/ai-worming-through-word/#atom-everything"
permalink: "https://feed.astralor.com/items/itm_c820e399634b2d738725a034"
published: "2026-07-29T18:43:03.000Z"
score: 79
channel: "ai"
tags: ["AI Security","Copilot","Microsoft","Prompt Injection","Self-Replicating Worm"]
---

# AI Prompt Injection Worm Targets Microsoft Word Copilot with Self-Replication

## AI commentary

> This case reminds me of early computer worm propagation logic, but now the 'host' is an LLM-driven Copilot. For any organization using AI assistants to handle sensitive documents, this is a new attack surface that must be guarded against — it no longer relies on users clicking malicious links, but on the AI's 'over-trust' in context. Security teams should immediately audit Copilot's document access policies and restrict external document sources.

## At a glance

Security researcher Håkon Måløy has identified a new prompt injection variant targeting Microsoft Word Copilot. By embedding hidden instructions in a document, Copilot may misinterpret them as part of the user's request, causing it to manipulate the document and copy the instructions into new documents, creating a self-replicating worm. The attack can propagate across multiple Copilot workflows without requiring the attacker’s original document. The vulnerability was responsibly disclosed to Microsoft, but after 144 days, no comprehensive mitigation has been implemented.

## Key points

- Attackers embed hidden instructions in a Word document; when Copilot uses it as source, the instructions are mistaken as part of the user request.
- Copilot not only manipulates the current document but also copies the instructions to the output, turning new documents into carriers.
- Carrier documents trigger new executions when reused in Copilot workflows, enabling propagation without the original document.
- Microsoft has not released a comprehensive fix after 144 days, offering only partial mitigations.

## Full text

AI Worming through Word Neat new prompt injection variant by Håkon Måløy, who found a way to upgrade prompt injection attacks against Microsoft Word to full self-replicating worms: An attacker places hidden instructions in a document that is later used as source material in Copilot for Word. Copilot may interpret those instructions as part of the user’s request, causing it to manipulate the document being drafted or edited. Copilot may then also copy the hidden instructions into the resulting document, turning that document into a new carrier. If the carrier is subsequently used in another Copilot-assisted workflow, the instructions can trigger again and propagate into further documents, even without the attacker’s original document being present. We've seen plenty of hidden white-on-white text before - the kids are using it in their job applications now - but this is the first one I've seen that deliberately copies instructions to self-replicate itself. It was responsibly disclosed to Microsoft who then had 144 days to work on a fix, but so far (unsurprisingly) there's no mitigation that covers the full class of attack. Via Hacker News Tags: microsoft, security, ai, prompt-injection, generative-ai, llms

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_c820e399634b2d738725a034