Overview
On July 28, 2026, security researcher Håkon Måløy publicly disclosed a new attack technique called “AI Worming through Word”. The attack exploits a hint injection vulnerability in Microsoft Copilot for Word, allowing malicious instructions to self-replicate and spread in normal document workflows, forming a new type of document-based AI worm. This discovery will prompt the escalation of injection attacks from a single-interaction threat to a persistent risk with self-replication capabilities.
Attack Principle
The attack exploited a fundamental design flaw in the LLM architecture. In order for the AI assistant to function, it must process external information such as emails, documents, web pages, memories, etc. that may be controlled by attackers; and this information must be incorporated into the context window of the model and participate in the same calculation process as system instructions and user requests. The problem is that the model must process external content before it can determine whether it contains an attack; but by the time it makes a judgment, the text controlled by the attacker has already affected the computational process that produced that judgment. This “process first and then identify” dilemma means that any system that integrates LLM into a trusted workflow must recognize a default risk: once external content enters the model context, there is a certain probability of causing harm.
The stealth of the attack is due to Copilot for Word’s special handling of text formatting. Copilot strips away all text formatting information, including font color and size, before passing the document content to the underlying LLM. Therefore, the hidden text with white characters on a white background and very small font size is completely visible to the model but invisible to users. Attackers can embed malicious instructions in JSON format into seemingly normal documents in this stealthy form, and users cannot visually detect any abnormalities.
Two prerequisites are required to trigger an attack: the victim must include a document containing hidden instructions in the context of Copilot; the malicious document is included in the context window of Copilot. This can be achieved by users actively uploading documents, or by allowing Copilot to retrieve relevant documents from OneDrive on its own through the “Edit with Copilot” function. Instead of hacking into the victim’s Microsoft 365 tenant, an attacker can simply deliver malicious documents to the target user through SharePoint, Teams, Outlook or any regular document sharing channel.
Attack Process
The attack is divided into two stages: initial implantation and contamination, and self-replication and diffusion.
Phase 1: Initial implantation
The attacker first constructs a document carrying hidden malicious instructions. These instructions are written in JSON format and hidden at the end of the document using white fonts and very small font size. The attacker sent this document to the target user through regular sharing channels.
Constructed initial attack vector file, the attack scheme is attached to the end of the file in white text
When a user drafts or edits a document using Copilot for Word and introduces the malicious document as an attachment into context, Copilot reads the entire text content, including hidden instructions. The model treats these instructions as part of the user’s request and executes them. In the researcher’s proof of concept, the malicious instruction required Copilot to halve all the numbers in the financial report; at the same time, the second part of the instruction required Copilot to copy the complete malicious prompt to the end of the generated document, also hidden in small white letters. Copilot does not issue any prompts or warnings to the user during execution. Finally, a seemingly completely normal financial report is generated, but the data in it has been tampered with, and the document itself becomes a new attack vector.
After Copilot halved all financial data in the draft report according to malicious requests, it also attached a complete attack prompt in white text. It neither mentions the data halving operation nor does it indicate that it contains attack content
It is worth noting that Copilot does not require users to actively upload malicious documents. In “Edit with Copilot” mode, Copilot automatically searches the user’s OneDrive for documents related to the current task and puts them into context. An attacker can trigger an attack by simply placing a malicious document in the target user’s OneDrive and making its content related to the topic of tasks that the user may perform.
Stage 2: Self-replication and dissemination
Once the victim saves and shares this contaminated document, the attack enters the second stage. If another colleague uses this document as an attachment for his own Copilot drafting task, the hidden instructions in it will be read and executed again. Copilot will tamper with the data in the new document again and copy the complete malicious prompt to the new document. This process can be repeated indefinitely within the organization.
The contaminated documents are generated by legitimate internal resources and naturally carry the credibility of internal documents. By sharing it with partners or uploading it to a shared SharePoint site without the victim’s knowledge, the attack may cross organizational boundaries and spread to external institutions.
Attack Threat and Consequences
The attack is essentially a document-based AI worm with the ability to self-replicate and automatically spread. Attackers do not need to continuously access the victim’s environment or repeatedly deliver malicious payloads. They only need one initial delivery to achieve automatic spread through normal document collaboration processes. A serious asymmetry is formed between the cost of an attack and the scope of its impact.
The most direct consequence of the attack is that information integrity is compromised. In the proof of concept, Copilot quietly halved the financial figures without giving any prompts to users. If this were in an actual attack scenario, tampering would be completely invisible. This means that any decision made by relying on documents generated or edited by Copilot may be based on tampered information.
In addition, the attack is extremely difficult to trace and has the potential to spread across organizations. It is foreseeable that the potential impact of such attacks will be dramatically amplified as Copilot is combined with more deeply integrated systems. Currently, Microsoft has tried several mitigation measures during the 144-day coordinated disclosure period, including deploying a new “Edit with Copilot” experience and upgrading the underlying model to GPT-5.5 and 5.6, but the attackers still successfully reproduced the complete worm transmission chain. Such vulnerabilities are common in all current mainstream LLM systems, and there is no complete fix.
Case Summary
This is the first known document-based AI worm to achieve self-replication in a mainstream commercial office suite. It pushes the contradiction of “processing first and then identifying” from theory to reality: in the current architecture, system instructions, user requests and external content are processed equally in the same context window, and the model cannot distinguish between trusted intentions and untrusted information before performing calculations. As long as the model still needs to process external input before judging security, attackers will always find opportunities for malicious content to participate and influence the judgment process.
For organizations that rely on AI to assist decision-making, information integrity has become a core security concern. The traditional security system is built around access control, vulnerability patching and boundary defense. Facing this kind of attack on system cognition requires a new protection idea. This is not a problem that can be solved by a single patch, but a long-term issue that requires the entire industry to continue to explore at the architectural level.
References
[1] Håkon Måløy. Context Collapse, Part 3 – AI Worming through Word. – https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/
[2] Simon Willison: AI Worming through Word. – https://simonwillison.net/2026/Jul/29/ai-worming-through-word/
[3] Brandon Vigliarolo: Word worm crawls into Copilot, spreads chaos. – https://www.theregister.com/security/2026/07/29/word-worm-crawls-into-copilot-spreads-chaos/
[4] Cybersecurity News: Microsoft Word Copilot Vulnerability Turns Hidden Prompts Into Self‑Propagating AI Worms. – https://cybersecuritynews.com/microsoft-word-copilot-vulnerability/
[5] CyberPress: Microsoft Copilot Word Flaw Lets Hidden Prompts Spread Self-Propagating AI Worms Across Documents – https://cyberpress.org/microsoft-copilot-word-hidden-prompts-ai-worms/
