Researcher Discloses Self-Propagating Copilot for Word Worm
Researcher Hakon Maloy disclosed a prompt-injection vulnerability on July 29 that can cause Copilot for Word to alter document output and propagate hidden instructions into newly created files. The Register reports that Maloy coordinated with Microsoft from March 2026, but testing after two mitigation attempts found the broader vulnerability class remained exploitable.
Researcher Hakon Maloy has publicly disclosed a document-borne prompt-injection vulnerability affecting Copilot for Word that can alter generated content and copy malicious instructions into newly created documents. The Register reported on July 29 that the vulnerability can be triggered when Copilot includes an untrusted Word document in its context.
Maloy, a Norwegian data scientist with a PhD in applied AI and machine learning, withheld the precise prompt payload in his public disclosure because he wrote that a robust mitigation for the vulnerability class was not available. "To my knowledge, this is among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite," Maloy wrote, according to The Register.
How the attack propagates
The reported attack uses hidden text in a Word document, such as white-on-white or very small text, to embed instructions that a user does not notice. If the document is supplied as context to Copilot for Word, the model can treat those instructions as part of the prompt rather than as untrusted document data.
The Register reported that Maloy's proof of concept could modify financial figures in a target document and propagate its instructions into files generated using that document as source material. Explainx characterized the issue as cross-domain prompt injection, or XPIA, with a propagation stage: the first interaction changes model output, while later generated documents can become carriers for the hidden payload.
This differs materially from classic Office macro worms. Macros execute code under an Office security model; this technique instead exploits an LLM context boundary in which user intent and untrusted document content are processed together. Disabling macros therefore does not address the reported Copilot-specific attack path.
Disclosure and mitigation status
According to The Register, Maloy began coordinating with Microsoft in March 2026 and delayed public disclosure twice. Microsoft mitigated the original proof-of-concept prompt, but Maloy reported that rewording the payload enabled renewed propagation after subsequent Copilot updates. He wrote that two mitigation attempts, including a model upgrade, did not close the broader vulnerability class after a 144-day coordination period.
For teams deploying AI assistants over enterprise documents, the report reinforces a recurring security constraint: content retrieved from files, email, webpages, and knowledge bases can contain adversarial instructions.
The reported vulnerability is relevant where Copilot-generated documents are reused as sources, because propagation can turn a single untrusted artifact into a repeated integrity risk.
Key Points
- 1Maloy reported that hidden Word text can alter Copilot output and propagate instructions into subsequent generated documents.
- 2Microsoft addressed the original proof of concept, but Maloy reported reworded payloads remained effective after 144 days.
- 3Document-connected LLM workflows face a broader integrity problem when untrusted content and user instructions share one context.
Scoring Rationale
The disclosure concerns a potentially self-propagating prompt-injection path in a mainstream enterprise productivity assistant, with implications for document integrity and AI-assisted knowledge workflows. It is a reported proof of concept rather than a confirmed widespread compromise, but the absence of a reported robust mitigation makes it notable for security and ML platform teams.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
