AI Prompt Injection Worm Targets Microsoft Word Copilot with Self-Replication
Score
79首次提出将提示注入与自复制蠕虫结合的攻击模型，技术细节清晰，信息增量高。
内容结构完整，包含攻击原理、传播机制、披露状态，但缺乏缓解建议的深入分析。
对企业安全团队有直接指导意义，可帮助评估自身Copilot使用环境的风险。
发布时间为2026年7月29日，即时跟进最新安全动态，时效性极佳。
来源于Simon Willison个人技术博客，作者在AI安全领域公认权威，引用原始研究者Håkon Måløy。
Base 87.5 × T2 Source weight ×0.9 = 79
Curation line 70Selected
Why selected
This discovery reveals an innovative attack surface in AI security with practical threat potential and forward-looking implications, but the lack of a full fix keeps the score moderately high.
AI commentary
「This case reminds me of early computer worm propagation logic, but now the 'host' is an LLM-driven Copilot. For any organization using AI assistants to handle sensitive documents, this is a new attack surface that must be guarded against — it no longer relies on users clicking malicious links, but on the AI's 'over-trust' in context. Security teams should immediately audit Copilot's document access policies and restrict external document sources.」
Quick overview
Security researcher Håkon Måløy has identified a new prompt injection variant targeting Microsoft Word Copilot. By embedding hidden instructions in a document, Copilot may misinterpret them as part of the user's request, causing it to manipulate the document and copy the instructions into new documents, creating a self-replicating worm. The attack can propagate across multiple Copilot workflows without requiring the attacker’s original document. The vulnerability was responsibly disclosed to Microsoft, but after 144 days, no comprehensive mitigation has been implemented.
- Attackers embed hidden instructions in a Word document; when Copilot uses it as source, the instructions are mistaken as part of the user request.
- Copilot not only manipulates the current document but also copies the instructions to the output, turning new documents into carriers.
- Carrier documents trigger new executions when reused in Copilot workflows, enabling propagation without the original document.
- Microsoft has not released a comprehensive fix after 144 days, offering only partial mitigations.
Full text
Showing the source text; the full translation is being generated.
An attacker places hidden instructions in a document that is later used as source material in Copilot for Word. Copilot may interpret those instructions as part of the user’s request, causing it to manipulate the document being drafted or edited. Copilot may then also copy the hidden instructions into the resulting document, turning that document into a new carrier. If the carrier is subsequently used in another Copilot-assisted workflow, the instructions can trigger again and propagate into further documents, even without the attacker’s original document being present.
We've seen plenty of hidden white-on-white text before - the kids are using it in their job applications now - but this is the first one I've seen that deliberately copies instructions to self-replicate itself.
It was responsibly disclosed to Microsoft who then had 144 days to work on a fix, but so far (unsurprisingly) there's no mitigation that covers the full class of attack.
Via Hacker News
Tags: microsoft, security, ai, prompt-injection, generative-ai, llms
Related items
89
FeaturedOpenAI Research: AI Is Redefining Job Boundaries
OpenAI研究：AI正在重新定义工作边界
If you care about the real impact of AI on work, this research is a must-read. Instead of theory, it uses data to show how ChatGPT users expand their task scope, offering direct insights for HR, managers, and every professional looking to upgrade their skills.
87
FeaturedOpenAI CFO Shares Five Lessons for Building an AI-Native Finance Function
OpenAI CFO 分享构建 AI 原生财务职能的五大经验
As an editor, I find this article uniquely valuable because it comes from a finance chief at an AI leader, not an external consultancy, making it highly practical. I recommend it to finance digitalization leads, CFOs, and anyone interested in AI-driven transformation.
87
FeaturedScientific Computing in the Age of Agentic AI: OpenAI Releases New Field Report
智能体AI时代下的科学计算：OpenAI发布新领域报告
This report is one of the most practical analyses in the current AI agent wave, especially suitable for practitioners in computational biology and drug discovery. It answers the key question 'What can AI agents do besides writing code?' and directly demonstrates productivity gains in complex scientific computing.
87
FeaturedReal World VoiceEQ: Measuring the Human Quality of Voice AI
Real World VoiceEQ：量化语音AI的人类自然度
What's noteworthy is that this benchmark truly focuses on the soft metric of 'human-likeness', not traditional speech recognition rate or MOS scores. For teams working on speech synthesis, voice cloning, or voice interaction, this is a highly practical reference tool that quickly identifies model deficiencies in emotion, prosody, etc. However, language support is currently limited; looking forward to future expansion.
85
FeaturedOpenAI Introduces AI Age Scorecard: A New Way to Measure ROI
OpenAI 推出AI时代记分卡：衡量投资回报的新方法
This blog post hits a sore point in the current AI industry: how to quantify input-output. For enterprise decision-makers deploying or planning large-scale AI, it helps avoid herd mentality. My personal advice: try defining 'useful work' based on your own business scenario, and avoid designing metrics that are merely formality.
85
FeaturedHow to Manage AI Investments in the Agentic Era: Focus on Useful Work per Dollar and High-Value Workflows
代理时代如何管理AI投资：聚焦每美元有用功与高价值工作流
This article is especially important for enterprises scaling AI agents. It reminds us that focusing solely on falling API prices is a trap; what really matters is the return per unit of work. I recommend CTOs and CFOs read it together and establish quantitative evaluation mechanisms internally.
85
FeaturedDesigning Organisations That Can Keep Up With AI: Organisational Latency as the Biggest Barrier
设计能跟上AI的组织：组织延迟成为最大障碍
What makes this article truly worth following is that it raises a neglected bottleneck: no matter how strong the technology is, if the organisation can't keep up, it's useless. For CTOs, CIOs, and transformation leaders, this is a more important framework than tech selection.
84
FeaturedRuff v0.16.0 Released: Default Rules Jump from 59 to 413, CI Pipelines Need Attention
Ruff v0.16.0 发布：默认规则从59条激增至413条，CI工作流需关注
For Python developers, this is an unmissable update signal. The significant increase in Ruff's default rules means we can no longer ignore potential issues in our code, and AI fix tools can lower the upgrade cost. Notably, Astral (OpenAI) is deeply integrating AI coding capabilities with static analysis tools, which may become the norm in future engineering practices.