The First Self-Replicating Prompt Injection Worm Targets Word

A researcher has demonstrated the first practical self-replicating prompt injection attack against Microsoft Copilot for Word — a document that, once opened and processed by Copilot, doesn’t just execute a malicious instruction once. It copies that instruction into whatever new document Copilot generates next, turning ordinary office workflows into an infection vector.

What Happened

Security researcher Håkon Måløy documented an upgrade to browser-style prompt injection that targets how Copilot for Word handles attached source documents, a finding Simon Willison flagged as a meaningful escalation on prior injection research. When a user attaches files for Copilot to draft or edit from, Copilot reads the full contents of those files to determine what’s relevant — including text formatted as white-on-white, invisible to a human reader but fully readable to the model once formatting is stripped away. A malicious document can hide instructions in that invisible layer telling Copilot to alter real content (Måløy’s demonstration targets financial figures) and, critically, to copy the entire hidden instruction set into whatever new document it produces, using the same white-text concealment technique.

Why It Matters

That second instruction is what makes this a worm rather than a one-off exploit. A compromised document doesn’t need to keep circulating for the attack to spread: once Copilot generates output from it, the output document itself becomes a new carrier. A colleague who later uses that generated document as source material for their own Copilot task triggers the same hidden instructions again, and the chain continues without anyone re-sending the original file. Because propagation happens through normal internal workflows — shared drives, OneDrive auto-discovery, colleagues reusing each other’s work as source material — the infected documents look and originate like legitimate internal files, which makes this harder to trace back to a single starting point than a traditional phishing-style attack.

What This Means for Builders

If your organization uses an AI assistant that reads attached or auto-discovered documents to generate new ones, the attack surface here isn’t the model’s judgment about any single malicious file — it’s the entire document ecosystem those files pass through. Content-scanning defenses that check a document once, at upload, don’t address a threat that re-hides itself in every generation the tool produces afterward. At the time of publication, Måløy reported no complete mitigation despite multiple attempted fixes, a useful reminder that “the vendor is aware and working on it” isn’t the same as “this is closed.” That’s a different threat model than the browser-based prompt injection vectors Opus 5 recently posted strong results against — this attack targets document-processing workflows entirely outside that testing surface, so a model or product hardened against one doesn’t automatically resist the other.

Researchers have been documenting prompt injection variants against browser-using agents for well over a year now; what’s new here is the target. Word documents are default trusted inputs inside almost every enterprise workflow — nobody treats a colleague’s report as a potential attack vector the way they’d treat an unfamiliar link — and that baseline trust is precisely what a self-replicating payload needs to spread quietly.

Source: Håkon Måløy

Content created with AI assistance and reviewed for accuracy.