AI Worming through Word
Simon Willison Simon Willison
Security researcher Håkon Måløy discovered a prompt injection vulnerability in Microsoft Word's Copilot that allows hidden instructions in documents to self-replicate across multiple files and workflows. The attack works by embedding hidden text that Copilot interprets as user commands, then copies those instructions into newly generated documents, which can trigger the same behavior in subsequent Copilot sessions without the original document. Microsoft received responsible disclosure 144 days ago but has not yet deployed a comprehensive fix for this class of attack.
Why it matters
AI Worming through Word Neat new prompt injection variant by Håkon Måløy, who found a way to upgrade prompt injection attacks against Microsoft Word to full self-replicating worms: An attacker places hidden instructions in a document that is later used as source material in Copilot for Word. Copilot may interpret those instructions as part of the user’s request, causing it to manipulate the document being drafted or edited. Copilot may then also copy the hidden instructions into the resulting document, turning that document into a new carrier. If the carrier is subsequently used in another Copilot-assisted workflow, the instructions can trigger again and propagate into further documents, even without the attacker’s original document being present. We've seen plenty of hidden white-on-white text before - the kids are using it in their job applications now - but this is the first one I've seen that deliberately copies instructions to self-replicate itself. It was responsibly disclosed to
