Glonce

Microsoft Copilot for Word hijacked by a self-spreading worm, unfixed after 144 days

securityThe Glonce editorsThe Decoder🔥77Glonce rating77Impact70Novelty75Relevance95Surprise65Players75Credibility80
Microsoft Copilot for Word hijacked by a self-spreading worm, unfixed after 144 days

Security researcher Håkon Måløy has shown that a prompt injection attack against Microsoft Copilot for Word can spread on its own, the way a worm does. The attacker plants instructions inside an ordinary Word document as white text on a white background, set at a tiny font size. A person opening the file sees nothing. Copilot sees all of it, because it strips color and font size before processing the text.

The replication step is what turns the trick into a worm. When someone uses the poisoned document as a source, Copilot runs the hidden instructions and copies them into the new file it produces. That file is now a carrier itself. Use it as a template later and the attack fires again. The report offers a business scenario in the conditional: a compromised market analysis pulled from the internet could manipulate a financial report, which then infects further reports.

Microsoft confirmed the behavior on March 31. Two fix attempts failed. After 144 days, Måløy published his findings with no fix in place, though he is holding back the payload text. AI researcher Andreas Kirsch had recently joked that he wished someone would build exactly this worm, to convince skeptics that AI security risks are real; Kirsch is not described as having any part in building it. Now it exists, and prompt injection remains an unsolved AI security problem.

Key facts

  • Håkon Måløy hides instructions in a Word document as white text on a white background at tiny font size; Copilot strips color and font size before processing, so it reads what the human reader cannot see.
  • Using the poisoned file as a Copilot source makes Copilot execute the hidden instructions and copy them into the generated document, which then becomes a carrier for the next round.
  • Microsoft confirmed the behavior on March 31 and two fix attempts failed.
  • Måløy published after 144 days with no fix in place, withholding the payload text.
  • AI researcher Andreas Kirsch had joked he wished someone would build this exact worm to convince skeptics that AI security risks are real; he is not described as involved in it.

Why it matters

Prompt injection is usually shown as a single shot: one poisoned input, one bad answer. This demonstration adds the part that makes malware malware, which is replication. Copilot does not merely obey the hidden instructions, it writes them into the document it produces, so every output becomes the next input. Documents in an office already move that way, as a report built from an analysis, a template reused for the next quarter. The attack rides the normal workflow instead of fighting it. Andreas Kirsch had recently joked that he wished someone would build precisely this worm so that skeptics would take AI security risks seriously. It now exists.

Who it affects

Anyone who feeds documents into Microsoft Copilot in Word, especially where the source material comes from outside the organization or where files are reused as templates. The chain described runs through ordinary corporate work: an external market analysis becomes a financial report, and the report seeds the ones after it. The source does not say which Office builds, tenants, versions or regions are affected, and it does not say whether other Copilot surfaces such as Excel or Outlook behave the same way. Microsoft is the other party here, having confirmed the behavior and failed twice to fix it.

How to use it

There is nothing to adopt. Måløy is withholding the payload text, so the writeup is not a recipe, and the source publishes no mitigation, no workaround and no fix timeline. What it does state precisely is the trigger and the mechanism: the attack fires when a document is used as a source or a template for Copilot in Word, and the concealment relies on formatting that Copilot discards, namely white text at tiny font size. Both of those are checkable properties of a file rather than a matter of what it looks like on screen.

How solid is it

This is a named researcher's demonstration, not an incident. Nothing in the source says the worm has been used against anyone or seen in the wild. What lifts it above a claim is Microsoft's own confirmation on March 31 and the two failed fix attempts that followed, which are the vendor conceding the behavior is real. The limits are worth stating plainly: the payload text is withheld, so nobody can reproduce the result from the publication alone; no CVE, advisory number or bug bounty is mentioned; the source does not say where or when the findings were published; and no year is given for the March 31 date.

Risks and caveats

The financial reporting chain is written in the conditional, as something that could happen, not something that has. The scope is unmeasured: no count of affected users, documents or organizations, and no word on whether Copilot in other applications shares the flaw. The source does not describe what the hidden instructions do beyond copying themselves, so there is no claim here of data theft or exfiltration. It also does not explain why the two fixes failed, which is the part that would tell you how deep the problem sits. And publishing while the behavior stands is its own risk: the technique is now public, unpatched, and Microsoft is given no comment in the source beyond the original confirmation.