A self-propagating AI worm in Microsoft Copilot for Word still has no fix after 144 days of disclosure

Microsoft Copilot for Word Can Spread a Self-Propagating AI Worm, and After 144 Days, There Is No Fix

Microsoft Copilot for Word can be turned into a document worm. Hidden instructions placed inside a file can hijack what the assistant writes, silently copy themselves into the output, and propagate every time that output is reused as source material in a new Copilot session. After 144 days of coordinated disclosure with Microsoft Security Response Center (MSRC), two failed mitigation attempts including a model upgrade to GPT-5.5, the vulnerability class remains fully exploitable. 1

This is not a single bug waiting for a patch. The root cause is architectural: when Copilot reads an attached document for context, it treats hidden instructions inside that document as if they were the user's own commands. 1 Those commands can alter the content Copilot produces and embed copies of themselves into the resulting file. Each new file becomes a carrier, and the cycle restarts whenever someone reuses it in another Copilot session.

How the worm spreads

The attack exploits a boundary that should separate untrusted document content from trusted user instruction. Copilot must read every attached document to determine which information to include in its drafting task, and instructions embedded in those documents are processed alongside the user's actual request. 1

Once triggered, the payload does two things. It alters the content Copilot produces, with the researcher's proof-of-concept demonstrating halved financial figures in a report. And it copies itself into the output document, concealed as white text. 2 That new document becomes a carrier. The next person who feeds it into their own Copilot workflow triggers the same cycle, with no further involvement from the attacker and no access to the victim's Microsoft 365 tenant. The attacker only needs an initial document shared through SharePoint, Teams, Outlook, or any other channel. 1

144 days, two failed fixes

The researcher, Hakon Maloy, submitted the initial report to MSRC on March 6, 2026, with reproduction steps, videos, and proof-of-concept prompts. Microsoft confirmed the behavior on March 31 and began mitigation work. 1

The first mitigation went live on April 3: a redesigned "Edit with Copilot" experience. Six days later, Maloy reproduced the attack using a new prompt variant and reported it as a separate case. 1

The second attempt came on July 14: a model upgrade to GPT-5.5. The next day, Maloy reproduced the worming behavior using GPT-5.6, the latest available model at the time. 1

Why model upgrades cannot fix this

Both interventions failed because the problem is not in the model. It is in the architecture. As long as Copilot ingests untrusted documents as context and generates new ones from that context, hidden instructions can ride along and reproduce. A newer model may parse the injection differently, but document content and user instructions still share the same input channel. 1

Prior work on AI worms exists. The researcher referenced Morris II, which demonstrated self-replicating prompt propagation in email-assistant ecosystems. But he described the Copilot for Word case as among the first public demonstrations of a document-borne AI worm self-propagating through normal workflows in a mainstream commercial productivity suite. 1

Commenters on Hacker News drew the parallel to a familiar predecessor: VBScript macro worms that spread through Office documents in the late 1990s. 2

What organizations can and cannot do

According to the researcher, no customer-side remediation fully addresses the issue at publication, and Microsoft's own testing has reproduced the attack with all current mitigations deployed. 1 The partial mitigations available include treating externally sourced documents as untrusted when used with Copilot, reviewing attached documents before starting a Copilot session, and inspecting Copilot-generated documents before reusing or sharing them. 1

Maloy disclosed at the class level rather than the payload level, arguing that defenders cannot reduce exposure to a risk they are unaware of. The coordination period agreed with Microsoft was exhausted, and testing showed no robust mitigation for the broader vulnerability class. 1

What this means for enterprises

The timing compounds the risk. In April 2026, Microsoft pushed "agentic" Copilot features into general availability across Word, Excel, and PowerPoint. According to Microsoft, Copilot can now take actions on the user's behalf rather than merely suggesting edits. 3 More autonomy over document content means a larger surface for injected instructions to act on.

Firewalls, data loss prevention tools, and identity controls do not address this attack. The infection travels inside documents that the organization itself creates and shares, through workflows that IT has approved and deployed. For any team running Copilot across document workflows, the question is not whether a specific exploit works on a specific model version. It is whether the architecture of LLM-assisted document generation can separate trusted instruction from untrusted input at all. After 144 days and two failed fixes, that question remains open.