Microsoft Confirms AI Worm Spreads Through Word Documents Using Copilot

A Norwegian AI researcher has published a detailed report demonstrating a self-propagating Copilot AI worm that uses Microsoft Word as its primary delivery mechanism. The flaw allows hidden instructions inside a document to hijack Copilot’s document-generation workflow, effectively turning a routine corporate file into a vector for data manipulation and lateral movement. Microsoft has since confirmed the findings and deployed targeted mitigations, though the underlying architectural vulnerability remains unresolved. This development highlights a growing class of AI-native threats that exploit the boundary between human-readable data and machine-executable commands.

How the Copilot AI Worm Spreads Through Word Documents

The worm does not rely on executable code, Office macros, or remote access tools. Instead, it leverages prompt injection, a technique where concealed text inside a document is treated by the AI model as a direct command rather than source material. When a user opens an infected file and asks Copilot to summarize, edit, or generate a new report based on it, the model processes the hidden instructions. Those instructions then rewrite portions of the output document, embedding the same malicious payload into the newly created file. The cycle repeats the moment that new document enters another Copilot-assisted workflow.

Håkon Måløy, the researcher behind the report, described this as one of the first public demonstrations of document-borne AI-worm self-propagation through standard commercial productivity tools. The attack chain requires no phishing links, no special permissions, and no external command-and-control servers. It simply rides on the exact collaboration habits that enterprises have spent years optimizing. From a technical standpoint, the payload typically hides in document metadata, hidden text fields, or formatted blocks that standard view modes do not display. When Copilot parses the file structure to extract context, it pulls those blocks directly into the model’s processing window, treating them as operational guidance.

This behavior mirrors how large language models handle retrieval-augmented generation, where external documents are ingested to provide context. The distinction between reference material and executable instruction is not always explicit in the underlying architecture, which creates the propagation window. Måløy noted that the coordinated disclosure process showed mitigations can meaningfully reduce the demonstrated attack surface, making attacks less reliable and limiting their reach, even without completely eliminating the underlying problem.

Why Traditional Security Controls Fail to Block It

Traditional endpoint and network security tools are built to detect malicious payloads at the point of delivery. Email gateways scan attachments for known malware signatures. Data loss prevention systems monitor outbound traffic for sensitive information. Endpoint detection and response platforms watch for suspicious process execution. None of these controls trigger here because the document arrives completely clean. It only becomes hostile after Copilot processes it.

Aman Mahapatra, chief strategy officer at Tribeca Softtech, explained that the attack sidesteps data loss prevention because the exfiltration happens through the user’s own authenticated Copilot session. It also bypasses endpoint protection because no code executes. Only instructions get followed by an AI service the enterprise has explicitly authorized. The core problem traces back to a decades-old computing challenge: distinguishing between data and instructions.

Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, pointed out that the same confusion between mixed data and executable commands caused SQL injection vulnerabilities in relational databases. The industry solved it with parameterized binding, which forces the database to treat external input strictly as data. Generative AI systems, by contrast, still struggle to draw that line reliably. The architectural gap persists because LLMs are trained to interpret natural language contextually rather than syntactically. When a document contains both narrative content and embedded directives, the model evaluates them through the same probability distribution, making it difficult to isolate malicious payloads without breaking legitimate functionality.

Microsoft’s Response and Current Mitigations

Microsoft confirmed the findings via CSOonline and the Windows Insider Blog, stating it has addressed the reported vulnerabilities through a coordinated disclosure process with Måløy. The company deployed multiple focused mitigations since March 3, though the core architectural flaw remains unresolved. Microsoft emphasized a defense-in-depth strategy, noting that safeguards block malicious instructions at multiple points to keep tasks aligned with user requests. The company also stated it is continuously strengthening these protections as the threat landscape evolves.

In practice, these mitigations likely include input sanitization routines that strip hidden formatting before context injection, rate limits on cross-document reference extraction, and behavioral monitoring that flags when Copilot modifies source material it was only asked to summarize. Måløy acknowledged that the tweaks are helpful, but cautioned that separating instructions from data entirely is not a practical short-term fix. In real-world workflows, the boundary between the two is often intentionally blurred. A user asking an AI to plan a business trip needs the model to treat a booking procedure document as both reference material and actionable guidance.

The broader challenge, Måløy argued, is evaluating whether extracted instructions align with the user’s actual goals and the operating context. Tom Findling, CEO at Conifers.ai, agreed, noting that Microsoft does not need to wait for industry-wide architectural changes to harden the Copilot document path. Stopping hidden content from being written into new documents and surfacing concealed text before processing would significantly reduce risk. The company’s current approach prioritizes containment over elimination, which aligns with how it has handled indirect prompt injection in previous public statements.

What This Means for You

If your organization relies on Copilot for drafting reports, summarizing meetings, or generating spreadsheets, this vulnerability changes how you should treat external documents. The threat does not require a sophisticated attack campaign. It exploits a routine workflow: opening a file, asking an AI to process it, and sharing the output. For finance teams, legal departments, and operations managers, the risk is document integrity. A corrupted financial report or altered contract could circulate through internal channels while retaining the trust associated with its legitimate author and Microsoft 365 account.

Mike Wilkes, enterprise CISO at Aikido Security, described it as a dangerous enterprise supply chain where legitimate files inherit malicious behavior. The attack also creates audit blind spots. Because the carrier documents are generated by real employees using approved tools, there is no obvious point of origin once the payload begins moving. Organizations could be laundering corrupted data through their own workflows for weeks before noticing anomalies. Frank Dickson of IDC added that another critical problem is that the carrier documents are created by legitimate employees using legitimate tools, meaning there is no obvious point of origin once the payload starts moving.

The human factor remains the strongest defense. Copilot is designed to assist, not to autonomously validate the trustworthiness of source material. When an AI rewrites a document based on an unverified input, it inherits the input’s implicit authority. That means a single compromised file can quietly alter figures, shift deadlines, or modify contractual terms without triggering traditional alerting systems. The vulnerability does not require a zero-day exploit kit or a targeted phishing campaign. It only requires a document to enter a Copilot-assisted workflow.

How to Protect Yourself Right Now

Microsoft recommends installing the latest updates, maintaining multiple layers of security, treating content from unknown sources with caution, and reviewing AI-generated content before sharing. Beyond vendor guidance, security leaders can implement practical workflow controls today. Frank Dickson of IDC suggested restricting Copilot’s auto-discovery behavior, forcing users to manually select which documents the AI can access. This closes one of the two primary attack vectors and requires no infrastructure changes.

Another immediate control is enforcing visible change tracking for any AI-modified financial or compliance documents, paired with mandatory human approval before distribution. IT departments should also implement metadata tracking to log where content originated and which AI systems processed it. While this does not block the injection, it enables rapid tracing when a corrupted file surfaces. Dickson emphasized that this is not a technical fix, but a workflow one, and it is available today.

For administrators managing Microsoft 365 environments, conditional access policies and data classification labels can help restrict which document types Copilot is permitted to reference. Enabling audit logging for Copilot document interactions also provides visibility into unusual extraction patterns. Tyler Reguly of Fortra warned that the attack still resembles a laboratory scenario, noting that normal enterprise workflows rarely include the exact sequence of steps required for full propagation. The obscured example in the report contained a blank page with white text that would trigger immediate suspicion. The threat remains serious, but it currently demands a near-perfect storm of conditions to succeed.

Until the industry converges on a fundamental architectural solution for instruction-data separation, the most effective defense remains a combination of restricted document access, mandatory human review for high-stakes outputs, and rigorous metadata tracking. Microsoft has acknowledged the limitation and continues to ship incremental safeguards, but organizations should not treat the current mitigations as a complete resolution. The underlying model behavior that enables this propagation will likely persist until the broader AI ecosystem adopts standardized context isolation protocols.

Source: Computerworld

Over to you: Will your organization restrict Copilot’s document access, or rely on human review to catch injected prompts?