Self-Replicating AI Worm Discovered in Word: How Copilot Spreads Indirect Prompt Injections

July 30, 2026

AI SecurityWormprompt injectionCopilot

Sources：HN + web research · HN

Self-Replicating AI Worm Discovered in Word: How Copilot Spreads Indirect Prompt Injections

No links to click, no suspicious attachments to download. Simply opening Microsoft Word and asking Copilot to help write a document allows an invisible prompt to tamper with financial figures across an entire report—and silently embed the “infection source” into your newly generated document for the next colleague to process.

On July 28, 2026, Norwegian security researcher Håkon Måløy published a discovery that shook the AI industry: an AI worm can self-replicate and spread inside Microsoft Word via Copilot. The Microsoft Security Response Center (MSRC) collaborated with him over a 144-day disclosure period spanning two patch attempts and an underlying model upgrade (from GPT-5.5 to GPT-5.6), yet the attack vector remains reproducible.

This is not science fiction. It is happening today.

1. How Does It Work?

Setting technical jargon aside, let’s illustrate with a realistic scenario.

Imagine you are a financial analyst at a company. You download a market analysis report from the internet (which looks completely legitimate on the surface, but has been tampered with by an attacker). Visually, you notice no anomalies—the attacker inserted malicious instructions in tiny white text at the end of the document, completely invisible to the human eye.

You reference this report and ask Copilot in Word to help write your Q1 financial report. Copilot reads all reference documents provided—including that market analysis. That’s where the breakdown occurs:

Copilot reads the invisible text.

The hidden prompt instructs Copilot to cut all financial figures in the report in half, and then copy this exact instruction into the end of the newly generated document (also hidden in white text). Copilot obeys without question.

As a result, you receive what appears to be a normal Q1 report, but all numbers are quietly halved—and hidden at the end is the exact same malicious instruction. When you share this report with a colleague who uses it to draft the Q2 report, Copilot reads it, executes it, and spreads it once again.

The original malicious document is no longer present, yet the attack continues.

This is why researchers refer to it as an “AI worm”—much like a biological virus, it leverages the host’s (Copilot + Word) normal functionality to replicate itself.

Initial attack vector document—malicious prompt hidden in white text at the end of the document Figure 1: The attacker hides malicious instructions at the end of the document using tiny white text, invisible to human eyes. However, when Copilot ingests the document, text formatting is stripped, treating white text identically to normal text.

Tampered Q1 financial report—all figures cut in half Figure 2: In the Copilot-generated Q1 report, all numerical values are silently cut in half without any prompts or warnings from Copilot.

GPT-5.6 also fails to defend against the attack Figure 3: Even on GPT-5.6 (the latest available model at the time), the attack was still successfully reproduced.

2. A Fundamental Design Flaw: Blending Instructions and Data

Readers might ask: isn’t this just a bug? Can’t Microsoft simply issue a patch?

The issue is that this cannot be solved with a simple patch.

Måløy provided a clear assessment in his writeup:

“To make AI assistants useful, they must process emails, documents, web pages, memories, tool outputs, and other data—information that could be controlled by an adversary. To process this information, it must enter the model’s context window alongside system instructions, user requests, and other trusted context.”

In plain language:

To perform work for you, an AI must “read” everything you feed it. But the AI cannot distinguish between “data” (e.g., summarize this report) and “instructions” (e.g., cut the numbers in half).

In traditional computer security, instructions and data are strictly segregated. Typing “100” in Excel is data; writing =A1*2 is an instruction. The operating environment fundamentally understands the difference.

Large Language Models (LLMs) do not work this way. To an LLM, every string of text—whether a document, a user prompt, or hidden text inside a file—is mixed inside the exact same self-attention context window. It possesses no innate mechanism to separate “this is my user’s actual instruction” from “this is untrusted data embedded inside a reference file.”

This is the essence of prompt injection, a security dilemma discussed for years in the community.

Figure 4: Even if the victim does not manually upload the malicious file, Copilot will automatically search OneDrive and ingest it if it considers the document “relevant.”

3. Why Traditional Antivirus Fails

Traditional security software operates via pattern matching: collecting signatures of known viruses and alerting when identical byte patterns are found in local files.

AI worms, however, utilize natural language as their payload.

Malicious instructions can be expressed in endless variations—in English, Chinese, emojis, Base64 encoding, or steganographically inside images. An attacker can rewrite the same prompt 100 times with completely different signatures, and Copilot will comprehend every single one.

As a Hacker News commenter pointed out:

“You can hide malicious instructions in natural language anywhere in a document. No formal signature can pre-identify these ‘programs’.”

Crucially, Copilot is itself a general-purpose language processor. Adding a “filter” in front of it requires deploying another LLM-based inspector—which suffers from the exact same vulnerability. As Måløy noted:

“Detecting and removing malicious content just pushes the exact same problem out one layer.”

4. Dual Vulnerabilities: Architectural Defect vs. Defensive Reality

This crisis stems from two major factors.

Factor 1: Architectural Defects in AI Systems. Current LLM architectures lack any structural separation between instructions and data. This is a foundational issue with the current technology paradigm, not an oversight by a single vendor. Måløy terms this a “fundamental architectural weakness.”

Factor 2: The Defensive Dilemma. Microsoft rolled out two separate fixes over 144 days: first tweaking Copilot’s prompt framing (addressing Måløy’s initial payload phrasing), and later upgrading the underlying model from GPT-5.5 to GPT-5.6. Each fix blocked specific phrasing, but minor payload variations easily bypassed them again. Microsoft conceded that no client-side remediation can completely resolve this issue.

5. Two Perspectives

Proponents argue that this is the inevitable cost of progress:

“AI assistants are useful precisely because they can read documents and write content for you. You cannot abandon this capability just because a potential exploit exists. Security is a continuous process of mitigation, not a binary state.”

Skeptics take a far more critical stance:

One of the highest-rated comments on Hacker News read: “Until instructions and data are processed separately, this class of vulnerability simply cannot be fixed.”

Another commenter drew parallels to a classic chapter in computer history—the Von Neumann architecture:

“We are back to the Von Neumann architecture, and in the worst possible way.”

In early computing, programs mixed code and data in the same memory space, giving birth to buffer overflows and execution flaws. Hardware later introduced execution prevention bits (such as the NX bit) to enforce physical separation. Modern AI architectures, however, mix instructions and data seamlessly inside context windows without any physical boundary.

6. What Are the Implications?

This research is significant because it highlights a deeper reality:

As AI systems gain agency to read documents, interpret intent, and execute actions, the security of information itself—including text content and embedded instructions—becomes the primary attack surface.

A Word document shared within a company was historically passive data. Now, text inside it can turn into executable code via Copilot—altering financial figures, modifying logic, and replicating itself into downstream documents without any adversary present in the network.

Måløy’s concluding statement captures the core takeaway:

“Any system integrating LLMs into trusted workflows today must operate under the assumption that adversary-controlled content entering the model’s context window carries a non-zero probability of compromising the system.”

This is an engineering reality, not alarmism.

7. Final Thoughts

The findings presented here originate from Part 3 of Håkon Måløy’s Context Collapse series, validated through 144 days of coordinated disclosure with MSRC. As of public release, Microsoft has yet to provide a complete fix.

AI assistants offer immense productivity gains. But utility and security are distinct challenges. The vulnerability of modern AI agents stems from this fundamental design flaw: the blending of instructions and data.

Just as the software industry took over a decade to adopt input validation as a core security paradigm, the AI field faces a similar paradigm shift. Until then, stay vigilant.

Author’s Note: This article is intended for educational purposes and does not assess the absolute security of any specific product or company. Security is a continuous system engineering process without silver bullets.