AI Worming through Word

A security researcher named Håkon Måløy discovered a self-replicating prompt injection attack variant targeting Microsoft Word and its Copilot assistant. An attacker can embed hidden malicious instructions within a source document, which Copilot reads and interprets as part of the user request during drafting or editing.

This flaw allows Copilot to manipulate the current document and copy the hidden instructions directly into the newly generated file. As a result, the newly created document becomes a carrier that can propagate the instructions into additional documents during future Copilot-assisted workflows, continuing the cycle even if the original attacking document is removed.

While similar to traditional hidden text tricks, this method is the first known instance where hidden instructions deliberately copy themselves to achieve self-replication through generative artificial intelligence. The vulnerability was responsibly disclosed to Microsoft with a 144-day window for a fix, but a comprehensive mitigation that fully covers this class of attack has not yet been released.