Document-borne AI worms can self-propagate through Copilot for Word

I would for illustration to convey Microsoft merchandise teams and Microsoft Security Response Center (MSRC) for collaborating pinch maine connected this method study and mitigation of the disclosed vulnerabilities. The editorial opinions reflected beneath are solely the author’s and do not needfully bespeak those of the organizations I collaborated with.

Summary

The findings described successful this station are portion of a coordinated disclosure pinch MSRC and Microsoft merchandise teams. Microsoft was provided pinch reproduction steps, videos, biology assumptions, and the nonstop proof-of-concept (PoC) prompts utilized during testing. They were besides informed of a 90-day coordination play earlier disclosure. This was extended 2 times, resulting a 144-day coordination period.

In parts 1 and 2 successful this series, I person shown really outer inputs could power Copilot responses and, successful immoderate cases, perchance lead to confidentiality impacts done Cross-Domain Prompt Injection Attacks (XPIAs). This study builds connected those findings and extends the XPIA study from single-interaction discuss to propagation crossed trusted archive workflows. It shows that attacker-controlled instructions successful 1 archive tin beryllium copied into Copilot-generated aliases Copilot-edited Word documents, causing those downstream documents to go caller carriers of the aforesaid attack.

Previous examples of AI-worms exist. Notably, Morris II demonstrated self-replicating punctual propagation successful GenAI-powered email-assistant ecosystems. However, to my knowledge, this is among the first nationalist demonstrations of document-borne AI-worm self-propagation done normal workflows successful a mainstream commercialized productivity suite.

The reported script is:

1. Malicious instructions hidden successful an externally shared archive could make Copilot change drafted aliases edited documents successful Word and propagate the onslaught to caller documents.

The afloat onslaught successful brief

The attack

An attacker places hidden instructions successful a archive that is later utilized arsenic root worldly successful Copilot for Word. Copilot whitethorn construe those instructions arsenic portion of the user’s request, causing it to manipulate the archive being drafted aliases edited. Copilot whitethorn past besides transcript the hidden instructions into the resulting document, turning that archive into a caller carrier. If the bearer is subsequently utilized successful different Copilot-assisted workflow, the instructions tin trigger again and propagate into further documents, moreover without the attacker’s original archive being present.

Example

Consider an worker preparing a financial report. The worker downloads a marketplace study from a trusted website that has been compromised, unaware that the archive contains hidden instructions. The worker past includes the study arsenic root worldly erstwhile drafting the study pinch Copilot. The hidden instructions origin Copilot to change soul figures successful the financial study and transcript the onslaught into the caller document. The worker saves and shares the apparently morganatic study internally. Later, a workfellow uses it arsenic root worldly for different report; the instructions trigger again, change the caller report, and transcript themselves forward. The onslaught tin truthful proceed without further engagement from either the compromised website aliases the original malicious document. As affected reports are reused, further reports and documents tin go carriers of the attack.

Disclosure position astatine publication

• Vendor: Microsoft
• Coordinated disclosure: Handled done MSRC and Microsoft merchandise teams
• Included successful this post: XPIA and self-propagation script successful Microsoft Copilot for Word
• Customer action: No customer-side remediation afloat addresses the rumor astatine the clip of publication. Customers tin trim vulnerability by:
  1. Treating externally originated documents arsenic untrusted erstwhile utilized pinch Copilot.
  2. Reviewing immoderate attached archive earlier starting a Copilot procreation aliases edit.
  3. Carefully reviewing Copilot-generated aliases Copilot-edited documents earlier reusing, sharing, aliases distributing them.
• Microsoft-side status: Testing has reproduced the onslaught pinch each existent mitigations deployed. At the clip of publication, nary robust mitigation for the broader vulnerability people is available.

A statement connected disclosing earlier a fix

Unlike Parts 1 and 2, this script remains exploitable astatine publication. I person weighed that carefully. The coordination play agreed pinch Microsoft has been exhausted, and testing shows that nary robust mitigation for the broader vulnerability people is presently available. Two mitigation attempts, including a exemplary upgrade, did not adjacent the class.

I person truthful chosen to disclose astatine the people level alternatively than the payload level. My reasoning is that defenders cannot trim vulnerability to a consequence they are unaware of, and the propagation system described present affects mean archive workflows that galore organizations already trust on. Withholding the beingness of the rumor would time off those organizations incapable to make an informed decision, while providing nary further protection.

Disclosure timeline

• 2026-03-06: Initial study submitted to MSRC pinch reproduction steps, videos, biology assumptions, and PoC prompts.
• 2026-03-09: MSRC acknowledged receipt and opened a case.
• 2026-03-31: Microsoft confirms the reported behavior.
• 2026-03-31: Microsoft merchandise teams began mitigation work; ongoing method discussion.
• 2026-04-03: First mitigation go-live (The caller “Edit pinch Copilot” experience)
• 2026-04-09: Original onslaught punctual wording verified mitigated pinch “Edit pinch Copilot”.
• 2026-04-09: Attack behaviour reproduced successful “Edit pinch Copilot” utilizing a caller XPIA punctual task (manipulating financials). Reported arsenic abstracted lawsuit to MSRC.
• 2026-04-10: MSRC acknowledged receipt and opened a case.
• 2026-04-10: Microsoft merchandise teams began mitigation work; ongoing method discussion.
• 2026-06-08: At Microsoft’s request, nationalist disclosure was moved to 2026-07-15.
• 2026-07-14: Second mitigation hole go-live. This mitigation consisted of upgrading the underlying exemplary to GPT-5.5.
• 2026-07-15: Successful utilization pinch worming reproduced utilizing GPT-5.6, the latest disposable exemplary astatine the time.
• 2026-07-15: I propose we postpone disclosure a further 2 weeks to 2026-07-28, to let clip for a caller mitigation.
• 2026-07-15: Microsoft agreed.
• 2026-07-28: Attack still reproduces.
• 2026-07-28: Coordinated nationalist disclosure (this post).

Threat model

The attacker does not request entree to the victim’s Microsoft 365 tenant. The attacker only needs to stock a malicious archive pinch the victim. This tin beryllium done done SharePoint, Teams, Outlook aliases immoderate different measurement of sharing documents.

Security bound and observed behavior

The applicable information bound successful this script is the bound betwixt attached documents and the existent drafting document. If immoderate of the attached documents incorporate an XPIA the onslaught whitethorn trigger.

Copilot must publication each attached archive to find which parts to see successful its existent drafting task. However, attached documents should beryllium treated arsenic untrusted information, not trusted personification instruction.

Boundary violation
Attacker-controlled documents are downloaded aliases shared done email/sharepoint/other sharing option. If specified documents are attached to Copilot during a drafting task, spot is broken.

Expected behavior
When a personification asks Copilot to draught e.g. a Q1 financial study based connected attached documents, Copilot should utilize the accusation successful the attached documents without treating instructions embedded wrong documents arsenic charismatic instructions.

Observed behavior
Instructions embedded successful documents origin Copilot to change its behavior. Here presented as:
1: Copilot silently changing numerical values successful financial reports
2: Copilot propagating the afloat XPIA by pasting into downstream documents, which whitethorn past beryllium utilized arsenic attachments successful later drafting sessions\

Crossing the spot bound successful Word

The first onslaught vector for these scenarios uses a malicious document. The malicious archive contains a JSON-formatted malicious punctual that triggers the onslaught erstwhile the archive is included successful Copilot’s context. The punctual tin beryllium rendered arsenic achromatic matter connected a achromatic inheritance and successful a mini font size to conceal it from the victim. Since Copilot for Word strips each matter formatting for illustration colour and font size earlier passing the matter into the underlying Large Language Model (LLM), this matter remains afloat readable to Copilot moreover though the unfortunate cannot spot it. The onslaught tin beryllium further concealed by embedding it successful a seemingly benign archive pinch task-relevant text.

This onslaught requires the malicious archive to beryllium included arsenic portion of Copilot’s discourse successful Word. Thus, depending connected the type of Copilot successful use, the unfortunate must either:

1. Actively connect aliases upload the archive successful Copilot for Word.
2. Use the “Edit pinch Copilot” functionality successful work/Work IQ mode and fto Copilot find the malicious archive successful the victim’s OneDrive. In this case, Copilot must deem the archive applicable and see it successful the context. An attacker truthful needs to trade a archive that increases the likelihood of either aliases both.

The utilization is applicable some for the “magic pen” and the “Edit pinch Copilot” functionalities successful Word.

The onslaught happens successful 2 stages. The first shape establishes foothold and successful the 2nd shape the onslaught self-propagates crossed documents that usage Copilot for Word arsenic portion of drafting aliases editing.

Stage 1:

In the first shape the attacker has crafted a archive that contains a malicious hidden prompt. In my first PoC I utilized a archive that only contained the malicious punctual arsenic achromatic matter connected achromatic background. This was done to exemplify that the malicious archive did not request to beryllium applicable to the victim’s task for Copilot to usage it. If it was included successful the context, it is publication and truthful the onslaught whitethorn trigger.

The PoC punctual was system successful 2 parts:

• The first portion contained the instructions connected really to impact a document. This could scope from somewhat changing meanings of summaries to altering numbers successful financial documents. The cardinal was formulating the punctual successful a measurement that made Copilot judge it was task-relevant and benign. In galore of my experiments I really needed to besides instruct Copilot to item which changes it made, since they were often meaningful changes that were difficult to spot. This shows really effective the onslaught is astatine subtly changing the matter successful meaningful ways that easy elude moreover an attentive reviewer. In a real-world setting, the attacker would evidently not see specified instructions. For the remainder of this disclosure, therefore, I’ll usage altering numbers successful financial reports since that is an instantly visible change.

• The 2nd portion contained the instructions to self-propagate the attack. The nonstop wording besides matters here, but it was mostly framed arsenic serving the intent of search sources successful downstream documents. It besides contained instructions connected really to hide itself, framed arsenic instructions to amended readability.

Figure 1: The first onslaught vector document. I created a afloat mock institution named Tfosorcim Ltd. for this PoC, pinch mock economics and vision. This onslaught vector archive is simply a clone marketplace study made utilizing accusation astir the institution that would typically beryllium disposable to an attacker. The onslaught is appended astatine the extremity of the archive utilizing achromatic text. [Most of the XPIA matter is blurred for security]

Once this malicious archive was included successful the discourse erstwhile drafting aliases editing a archive pinch Copilot for Word, the onslaught would trigger and Copilot would execute the instructions. Thus, the affected archive would person financial numbers changed. Copilot would past besides transcript the full malicious punctual into the bottommost of the affected archive utilizing achromatic matter and font size 8, efficaciously concealing it from the victim.

Figure 2: The downstream draught generated by Copilot utilized my malicious archive arsenic an attachment ([att] Direct wmr.docx). In the resulting Q1 financial study draft, each financial numbers are halved. The screenshot besides shows different attached documents (Tfosorcim soul documents).

Figure 3: The fig demonstrates that GPT-5.6, the latest exemplary from OpenAI astatine the clip of writing, was utilized successful these PoCs.

Figure 4: After having halved each financial numbers successful the Q1 financial study draft, Copilot besides appends the afloat onslaught punctual utilizing achromatic matter to efficaciously conceal it from the victim. It besides makes nary mention astir its halving of numbers aliases that it includes the attack. Thus, the unfortunate is clueless of it. [Most of the XPIA matter is blurred for security]

Figure 5: Copilot does not require the unfortunate to connect the malicious archive though. In this screenshot the unfortunate only instructs Copilot to constitute a Tfosorcim Q1 financial report. Copilot past searches done the victim’s OneDrive to find applicable documents. Among the documents, we find the malicious Market Analysis document. This archive does not reside successful the aforesaid files arsenic the remainder of the Tfosorcim document. However, Copilot still finds it, sounds it and is successfully exploited.

Stage 2:

Stage 2 is the self-propagation stage. It relies wholly connected the instruction for Copilot to transcript the malicious punctual into the affected document. Once the affected archive contained the prompt, the caller archive itself became the caller onslaught vector.

Figure 6: The screenshot shows a caller drafting convention utilizing Copilot. This clip the original onslaught vector is nary longer included among the attachments. However, the antecedently created archive is (Tfosorcim Q1 2026 report.docx). The consequence is the same, and Copilot again halves each financial numbers successful the drafted Q2 financial report.

Figure 7: In summation to halving each financial numbers, Copilot adds the afloat onslaught prompt, again utilizing achromatic text. Thus, the onslaught propagates done Word documents, efficaciously creating a document-borne AI worm. [Most of the XPIA matter is blurred for security].

Of note, this caller onslaught vector is now an internally created document, pinch each the spot that follows. Thus, the unfortunate needs only stock this archive pinch coworkers for the onslaught to spread. If the unfortunate aliases a workfellow past uses the affected archive arsenic an attachment to Copilot for Word while drafting aliases editing, the onslaught spreads to these caller documents.

In each reported PoC scenarios, Copilot would change generated aliases edited documents and transcript the hidden instruction into these documents. When these documents were themselves utilized arsenic portion of the discourse for caller downstream documents, the onslaught triggered again. Note that for the 2nd phase, the original onslaught archive was nary longer portion of the attachments for the caller downstream documents, yet the onslaught triggered and dispersed to these arsenic well.

Impact

Since the onslaught is capable to dispersed done soul documents, erstwhile it has moved beyond its first constituent of entry, the traceability of the onslaught becomes highly difficult. This is further exacerbated by each archive being created by a morganatic soul assets and that Copilot edits are not made visible aft they person been approved by the victim. The broader interest is that, if the onslaught silently dispersed wrong an statement done mean archive workflows, it could erode the informational instauration connected which organizations make decisions.

In addition, organizations that are not alert that they are affected by the onslaught are besides apt to dispersed it to different organizations done collaborative efforts connected shared Microsoft SharePoint sites aliases shared Microsoft Teams. Thus, the first onslaught vector for a peculiar statement whitethorn really travel from an already affected trusted partner. This again increases likelihood of the unfortunate choosing to see the affected archive successful the Copilot for Word discourse during drafting.

Recently Copilot is besides becoming much profoundly integrated pinch systems specified arsenic Microsoft Cowork aliases Microsoft Scout, which widen the adjunct to automatic manipulation and creation of documents, tools, and collaborative workflows. In specified systems the applicable effect of the issues described present whitethorn standard rapidly. The underlying system remains the same, but the imaginable aboveground complete which it tin propagate aliases power expands astatine instrumentality speed.

Mitigating the vulnerabilities

Microsoft successfully mitigated the primitively submitted PoC prompt, and deployed aggregate fixes complete the people of this disclosure. Each of these raised the barroom by closing the circumstantial payloads reported, and reproducing the behaviour afterwards required altered payloads alternatively than reusing the aged ones directly.

The original report, however, besides described the broader vulnerability class, successful which instructions embedded successful a root archive could power Copilot’s procreation and transcript themselves into downstream documents. Changing the requested action aliases wording changes the payload, but not the underlying vulnerability aliases propagation mechanism. Using a modified payload, the complete onslaught concatenation has been reproduced pinch each mitigations deployed (the PoC successful this study is 1 specified case). The vulnerability people truthful remains exploitable astatine the clip of publication.

That the people is not yet afloat closed reflects really difficult the underlying problem is. As the closing thoughts discuss, the weakness is architectural and shared crossed existent LLM-based systems. I’m not alert of a complete mitigation for this people successful immoderate comparable merchandise today. Fully resolving it requires investigation alternatively than a azygous patch. Within those limits, Microsoft’s fixes meaningfully trim exposure, and the representation and email-body vectors covered successful Parts 1 and 2 were mitigated outright. I would for illustration to convey Microsoft for their continued and substantive effort connected a genuinely difficult problem.

Implications

Taken together pinch the 2 erstwhile parts successful this series, these findings constituent to a broader rumor successful modern activity environments. Namely that the integrity of accusation becomes a superior information interest successful systems that merge LLMs arsenic portion of their operating workflows. The scenarios presented show that attacker-controlled contented tin not only power individual outputs and perchance leak information. The attacks themselves tin besides beryllium replicated and self-propagate done normal personification workflows.

This introduces challenges that widen good beyond first exploitation. Once malicious instructions are embedded successful generated content, they whitethorn persist crossed documents, beryllium redistributed by morganatic users, and beryllium reintroduced into caller contexts. At that point, the onslaught is nary longer limited connected its original introduction point. It has alternatively go portion of the system’s soul accusation flow.

A related accusation is the nonaccomplishment of traceability. Since affected contented is generated and modified done morganatic workflows, the root of the manipulation becomes difficult to place aft the fact. This complicates some discovery and response, peculiarly successful environments wherever specified contented is wide shared.

Independently of prompt-injection prevention, generated documents should sphere provenance for root worldly and model-performed edits successful metadata. Such controls would not forestall the underlying injection, but they could make traceability overmuch easier.

Closing thoughts

The findings successful this bid constituent beyond immoderate azygous merchandise aliases implementation. They expose a broader architectural weakness successful existent LLM-based systems.

For AI-assistants to beryllium useful, they often must process emails, documents, webpages, memories, instrumentality outputs, and different accusation that whitethorn beryllium controlled by an attacker. To process that information, it must beryllium included successful the model’s discourse window, wherever it participates successful the aforesaid computation arsenic strategy instructions, personification requests, and different trusted information.

This creates a basal problem: the LLM must process outer contented to find what it means, whether it is relevant, and whether it contains an attack. But by the clip it makes that determination, the attacker-controlled tokens are already influencing the computation that produces it. The contented being inspected participates successful the enactment of inspection. Relying connected the exemplary to observe XPIAs truthful resembles asking an expert to execute an untrusted programme to find whether that programme is safe to execute.

Detecting and removing malicious contented earlier it reaches the target exemplary simply moves the aforesaid problem outward.

Because LLMs tin retrieve semantics crossed radically different representations, an effective detector must person comparable semantic betterment capabilities. A detector weaker than the target LLM will screen a smaller representational space, leaving malicious formulations that the target understands but the detector fails to recognize.

The only mostly disposable exertion pinch comparable semantic capabilities is different LLM. Placing 1 exemplary successful beforehand of different whitethorn trim the occurrence complaint of peculiar attacks, but it creates an “LLMs each the measurement down” problem, wherever each LLM introduced to protect different LLM must itself beryllium protected.

The semipermanent situation apt lies successful designing systems successful which goals and intentions besides beryllium independently of the accusation being processed. Current LLM architectures supply nary reliable separation betwixt volition and interpretation. Thus, successful existent systems pinch embedded LLMs, attacker-controlled accusation tin power not only what the exemplary produces, but what the exemplary believes it has been asked to produce.

For that reason, immoderate strategy that integrates an LLM into a trusted workflow coming must presume that attacker-controlled contented entering the model’s discourse will consequence successful discuss astatine immoderate rate.

Change Log

The pursuing is simply a alteration log that shows which portion of this station person been changed and astatine what time. Spelling mistakes and akin errors will not beryllium logged. However, I will strive to see immoderate meaningful changes to the post.

• 2026-07-28: Change log added