A security researcher has demonstrated a novel prompt-injection attack that can transform Microsoft Copilot for Word into a self-propagating AI worm.
Unlike traditional malware, the attack requires no macros or executable code.
Instead, it embeds malicious instructions as white text on a white background within a Word document.
When a user asks Copilot to summarize, edit, or generate content from the document, the AI ignores the hidden formatting, interprets the concealed prompt as legitimate instructions, and unknowingly inserts the same hidden prompt into newly created documents.
Each edited file then becomes a new carrier, allowing the attack to spread through routine document sharing.
The researcher confirmed the worm remained effective even after Microsoft introduced mitigations and upgraded Copilot to newer GPT-5.5 and GPT-5.6 models, highlighting a broader architectural weakness in large language models where untrusted content shares the same context as trusted instructions.
Security experts recommend treating external documents as untrusted, carefully reviewing Copilot-generated content, and verifying AI-assisted documents before sharing to reduce the risk of prompt-injection attacks.
