The Worm in the Document: How an Attack Self-Propagates Through Copilot in Word

Working under coordinated disclosure with the Microsoft Security Response Center, a researcher has demonstrated the first public example of a “document” AI worm capable of self-propagating through ordinary workflows in a mass-market office suite. The suite in question is Copilot for Word.

How the attack works

The attacker needs no access to the victim's Microsoft 365 tenant — it is enough to share an infected document via SharePoint, Teams, Outlook or any other channel. Embedded in the document is an instruction in JSON format, typed in white-on-white in a tiny font. A human never sees it, but before passing the text to the language model Copilot strips all formatting, so the command remains fully legible to it.

When the user takes such a file as the source for a draft, Copilot treats the hidden directions as part of the assignment. In the demonstrated example, the assistant quietly halved every financial figure in a quarterly report without saying a word about it. What's more, Copilot appended the full text of the malicious instruction to the end of the new document, again in white font. In this way a freshly created, “trusted” internal report became a carrier of the attack itself.

Self-propagation

It is the second stage that makes this a worm. When the infected report is later used as the source for another document, the instruction fires again — this time without the attacker's original file being involved and without any call to the compromised site. The attack embeds itself into the organization's internal information flow, and it can spread among colleagues and, through shared SharePoint and Teams, on to partner companies.

The researcher notes one further point: the victim doesn't even have to attach the malicious file manually. In “Edit with Copilot” mode the assistant finds a suitable document in the user's OneDrive on its own — and becomes infected, even if the file sits in someone else's folder.

Why it can't be fixed

Over 144 days of coordination Microsoft shipped several fixes, including a model upgrade first to GPT-5.5 and then work carried out against the backdrop of the GPT-5.6 release. Each patch closed off a specific wording of the payload but not the vulnerability class itself: it is enough to reword the instruction, and the chain reproduces with every defense in place. As of publication, no reliable countermeasure against the entire class of attacks exists.

The author deliberately disclosed the problem before a complete fix was available — in his words, defenders cannot reduce a risk they don't know about. He advises users to treat external documents as untrusted and to carefully review everything Copilot has generated or edited.

The architectural essence

In closing, the researcher frames a broader idea. To understand external content, the model is obliged to place it in the context window — where it takes part in the same computation as the system instructions. The content being checked itself influences the checking process. Relying on the model to detect injections is like asking an interpreter to run an untrusted program in order to determine whether it is safe to run. Setting one model to guard another only spawns a “models all the way down” problem. Until LLM architecture separates intent from interpretation, any system with AI in a trusted process should be considered compromisable with some probability.

Source: Hacker News