Security researcher Håkon Måløy described a self-replicating prompt-injection attack that spreads through Microsoft Word documents processed by Copilot. Instructions hidden in a document can not only hijack the assistant but also copy themselves into new files — turning each one into a fresh carrier. The analysis was published on July 28, 2026, and amplified a day later by Simon Willison.
Key takeaways
- The attack targets Copilot integrated with Microsoft Word — the assistant treats hidden document text as user commands.
- Instructions are concealed as white text on a white background — invisible to humans, readable by the model.
- Copilot copies the hidden instructions into newly created documents, producing a self-replicating (worm) effect.
- Håkon Måløy disclosed the flaw to Microsoft under coordinated disclosure, working with the MSRC team.
- As of July 29, 2026 there is no comprehensive fix covering the full attack class.
How the attack works
The starting point is classic prompt injection — an attacker places instructions in a document meant not for a human but for the language model. The text is visually hidden, usually as white text on a white background, so the reader never sees it. When a user asks Copilot to process the document — to summarize or rewrite it, say — the assistant ingests the hidden fragment as reference material and treats its directives as commands issued by the user.
The novelty is what happens next. Copilot does not merely execute the hidden command in the current file — it can rewrite those same hidden instructions into a document it creates itself. The new file becomes another carrier. When a different user runs Copilot on it, the cycle repeats, without any access to the original source document. That capacity for self-propagation is what separates the attack from an ordinary one-off injection.
Why it is a new class of problem
A single prompt injection is a point threat: it affects one document and one session. A worm changes the scale — it spreads through the ordinary flow of files in an organization, much like Office macro viruses two decades ago. Conceptually it is not entirely new. In 2024 a team of researchers described Morris II, the first self-replicating worm exploiting generative AI in pipelines with email assistants. Måløy's work, however, demonstrates a concrete, working variant in a production tool used by hundreds of millions of people.
The key difference from traditional malware is that there is no exploit in the code here. Nothing is broken in the classic sense — the attack abuses the fact that the model is designed to read a document's content and act on it. The boundary between data and commands, which in classic software is enforced by architecture, is blurred in assistants built on language models.
Microsoft's response
Måløy reported the issue under coordinated vulnerability disclosure?Coordinated vulnerability disclosure: A researcher reports a flaw to the vendor and withholds publication until a fix is ready. and, in his own words, collaborated on the analysis with Microsoft product teams and the Microsoft Security Response Center. It took 144 days from report to publication. Even so, as of the publication date, no comprehensive fix covering the entire attack class has shipped — specific vectors were patched, but the underlying mechanism, in which the model trusts the document's content, remains.
Why it matters
This case shows that prompt injection is ceasing to be a research curiosity and becoming a real propagation vector in everyday tools. As long as AI assistants are wired into office suites with access to create and modify files, every document becomes a potential carrier of instructions. The scale of Word and Copilot means that even a low percentage of vulnerable workflows translates into an enormous number of real targets.
The problem is hard because it cannot be solved with a single patch. It requires a change in how assistants distinguish trusted user commands from document content — and that is an open research problem, not a bug to fix. The industry is only beginning to learn how to design defenses where the data-command boundary has vanished.
What's next?
- Microsoft is patching specific vectors, but — per the analysis author — the full attack class remains open, foreshadowing further variants.
- The analysis is the third part of Måløy's Context Collapse series — the author signals more publications on the data-command boundary in AI assistants.
Sources
- Simon Willison — AI Worming through Word
- enklypesalt.com (Håkon Måløy) — Context Collapse, Part 3 — AI Worming through Word
