Document-borne AI worms can self-propagate through Copilot for Word
Document-borne AI Worms: Self-Propagation via Copilot for Word
Source: Context Collapse, Part 3 - AI Worming through Word
Author: Håkon Måløy
Date: July 28, 2026
Reading Time: minutes
🛡️ Preface & Acknowledgments
The author wishes to express gratitude to the Microsoft Security Response Center (MSRC) and various Microsoft product teams for their collaboration during the technical analysis and mitigation efforts regarding these vulnerabilities.
[!IMPORTANT] The opinions expressed in this analysis are those of the author alone and do not necessarily represent the official views of the collaborating organizations.
📋 Executive Summary
This report is the result of a coordinated disclosure process with MSRC. The author provided Microsoft with comprehensive reproduction steps, including:
- Detailed videos.
- Environmental assumptions.
- Specific
Proof-of-Concept (PoC)prompts.
The initial 90-day coordination window was extended twice, totaling a 144-day period before public disclosure.
Evolution of the Research
In previous installments of the Context Collapse series (Parts 1 and 2), the author explored how external inputs could manipulate Copilot's output, potentially leading to confidentiality breaches via Cross-Domain Prompt Injection Attacks (XPIAs).
This third part elevates the analysis from a single-interaction compromise to a systemic propagation across trusted document workflows. The core discovery is that malicious instructions in one document can be mirrored into Copilot-generated Word files, transforming those files into new vectors for the attack.
While "Morris II" previously demonstrated similar self-replicating prompts in AI email assistants, this is one of the first public instances of a document-borne AI worm propagating through a mainstream commercial productivity suite.
🐛 The Anatomy of the Attack
The Core Mechanism
The attack relies on a cycle of injection and replication:
- Injection: An attacker embeds hidden instructions within a document.
- Execution: A user utilizes this document as a source for Copilot for Word.
- Manipulation: Copilot interprets the hidden instructions as user commands, altering the target document.
- Propagation: Copilot copies the malicious instructions into the new document, creating a new "carrier."
Propagation Flow
Real-World Scenario: The Financial Report Chain
Consider the following sequence of events:
| Step | Actor | Action | Result |
|---|---|---|---|
| 1 | Attacker | Compromises a trusted website and uploads a market analysis PDF with hidden prompts. | A "poisoned" source document exists online. |
| 2 | Employee A | Downloads the analysis and uses it as a reference to draft a financial report via Copilot. | Copilot alters internal figures and embeds the worm in the report. |
| 3 | Employee A | Shares the "legitimate" internal report with the team. | The worm is now inside the corporate perimeter. |
| 4 | Employee B | Uses Employee A's report as a source for a new executive summary. | The worm triggers again, altering the summary and replicating itself. |
Mathematically, the spread can be viewed as a growth function where the number of infected documents increases based on the reuse rate :
⚠️ Disclosure Status & Mitigation
Current Status at Publication
- Vendor: Microsoft
- Disclosure Type: Coordinated via MSRC.
- Scope: XPIA and self-propagation in Copilot for Word.
Customer Remediation
Currently, there is no complete technical fix available on the customer side. To reduce risk, users should follow this checklist:
- Treat all external documents as untrusted when using them as Copilot sources.
- Manually inspect attached documents before initiating a Copilot generation/edit.
- Rigorous review of all Copilot-edited content before sharing or distributing it internally.
Microsoft's Position
Microsoft has reproduced the attack even with current mitigations active. As of this writing, a robust solution for this entire class of vulnerability does not exist.
📢 Note on Premature Disclosure
Unlike the first two parts of this series, this vulnerability remains exploitable at the time of publication. The author chose to disclose the class of the vulnerability (rather than the specific payload) for the following reasons:
- The agreed coordination period has expired.
- Two mitigation attempts (including a model upgrade)
failed to close the vulnerability class. - Defenders cannot mitigate a risk they are unaware of.
- The propagation mechanism targets standard workflows used by thousands of organizations.
📅 Disclosure Timeline
2026-03-06 | Initial report submitted to MSRC (PoCs, videos, and steps).
2026-03-31 | Microsoft product teams begin mitigation and technical discussions.
2026-04-03 | Deployment of the new "Edit with Copilot" experience.
2026-04-09 | Original attack prompts verified as mitigated in "Edit with Copilot".
2026-04-09 | New XPIA prompt (financial manipulation) successfully bypasses "Edit with Copilot".
2026-04-10 | Microsoft resumes mitigation work and technical discussions.
2026-06-08 | [Timeline truncated in original text]