Self-Propagating AI Worm Rides Copilot for Word — No Fix at Disclosure

A security researcher has documented what appears to be the first public case of a self-replicating prompt-injection worm spreading through a mainstream productivity suite. The attack abuses Microsoft Copilot for Word: an attacker plants hidden instructions inside a document and shares it with a victim through SharePoint, Teams, Outlook, or any ordinary channel—no access to the target’s Microsoft 365 tenant required. When the victim attaches that document as source material for a Copilot drafting or editing task, Copilot treats the embedded text as authoritative instruction rather than untrusted data. It can then silently manipulate the output—for example, altering financial figures—and copy the malicious instructions into the new document, turning that file into a fresh carrier that infects downstream reports as colleagues reuse it, long after the original document is gone.

The technique extends the researcher’s earlier work on Cross-Domain Prompt Injection Attacks (XPIA) from single-interaction compromise to full propagation across trusted document workflows. Conceptually it echoes Morris II, which showed self-replicating prompts in GenAI email assistants, but this is the first demonstration of a document-borne worm inside a commercial office product. The core failure is a broken trust boundary: Copilot must read every attached document to decide what to include, yet it fails to distinguish reference content from commands.

Most significant is the disclosure posture. After a 144-day coordinated process with MSRC, the issue remains exploitable at publication. Two mitigation attempts failed to close the class—including model upgrades to GPT-5.5 and testing against GPT-5.6, both of which still reproduced the worm. With no robust vendor fix available, the researcher chose to disclose at the class level rather than share payloads, arguing defenders cannot manage a risk they don’t know exists. For now the only mitigations are operational: treat externally sourced documents as untrusted, review any attachment before running Copilot, and scrutinize Copilot-generated output before sharing it onward.