Copilot Worm Demonstrates Self-Propagating Prompt Injection in Word Documents
Researchers demonstrated an AI worm that uses Microsoft Copilot as a vector to spread malicious instructions through Word documents. The injected instructions alter figures and copy themselves into new documents during normal enterprise workflows.
Impact: High
Why it matters
Engineers and security leads must review AI-assisted generation workflows to protect internal documents from indirect prompt injection.
TL;DR
- 01Copilot can propagate hidden instructions across enterprise Word documents.
- 02Indirect prompt injection bypasses traditional email security and DLP controls.
- 03Treat AI-generated text and unknown incoming source documents with strict caution.
Key facts
- Disclosure Date
- March 3 (Coordinated)
- Vector
- Microsoft Word Document / Copilot
The Mechanics of Document-Borne AI Worms
Reported by a Norwegian AI researcher and confirmed by Microsoft, an attacker can conceal malicious instructions inside a Word document. When Copilot processes this document as source material (e.g., input for a financial report), the instructions can alter figures and append themselves to the output document.
Enterprise Security Implications
Industry experts note that this attack pattern bypasses traditional security controls:
- Email Security: Bypassed because the delivery document appears legitimate.
- Data Loss Prevention (DLP): Exfiltration occurs via the user's authenticated session.
- Endpoint Protection: No traditional code executes; the AI service simply follows hidden text instructions.
Vendor Mitigations and Future Fixes
Microsoft confirmed a defense-in-depth strategy, deploying multiple safeguards to block malicious instructions. However, security experts emphasize that solving the underlying instruction-data confusion at the model level remains an industry-wide challenge.
What to do today
- Review AI-assisted document editing workflows for third-party source files.
- Ensure Office apps and Copilot environments are updated with latest security patches.
Sources