Security researcher Håkon Måløy has disclosed a cross-domain prompt injection vulnerability affecting Microsoft Copilot for Word.
This vulnerability could allow malicious instructions hidden within documents to alter Copilot-generated content and spread into newly created files.
The issue, termed “Context Collapse, Part 3 – AI Worming through Word,” demonstrates how a document can serve as a carrier for a self-replicating prompt, effectively creating an AI worm that propagates through standard enterprise document workflows.
Microsoft Copilot Word Flaw
The reported attack begins when a victim uses an externally sourced or shared Word document as context for a Copilot drafting or editing request.
An attacker can embed malicious natural-language instructions in the source file, which may be concealed using white text on a white background and a very small font size.
While this content is often invisible or difficult for users to detect, Måløy found that Copilot extracts text without preserving its visual formatting, making the hidden content readable to the underlying large language model.
Instead of treating the embedded content as untrusted reference material, Copilot may interpret the attacker-controlled text as relevant instructions for the user’s request.
In a proof-of-concept scenario, the hidden prompt reportedly caused Copilot to change numerical values in a financial report silently. The model then appended the malicious instruction to the output document, using concealed formatting.
This newly generated internal document could trigger the same behavior when another employee uses it as context for Copilot, allowing the prompt to move from one document to another without needing the original malicious file.
Måløy described this behavior as an AI worm carried by documents because each affected document becomes a new vector for propagation.
For example, a compromised market analysis document could influence a Copilot-generated quarterly report, which is then shared internally as a trusted file.
If a colleague later uses that report to prepare a new document with Copilot, the hidden instruction may execute again, alter the new output, and reproduce itself.
This cycle can continue across platforms such as SharePoint, Teams, Outlook, and OneDrive, as well as within organizational collaboration workflows.
The researcher indicated that the attack does not require access to a victim’s Microsoft 365 tenant. An attacker only needs to ensure that a malicious document is shared with or downloaded by the target.
Depending on the Copilot experience in use, a victim may explicitly attach the document, or Copilot may identify it as relevant through OneDrive search in Work IQ-based workflows.
This broadens the risk beyond direct attachments, especially in organizations that rely on Copilot to locate supporting materials automatically.
According to the disclosure timeline, Måløy submitted the initial report to the Microsoft Security Response Center on March 6, 2026. Microsoft confirmed the reported behavior later that month.
It deployed multiple mitigations, including a revised “Edit with Copilot” experience and an underlying model upgrade.
However, the researcher stated that modified prompt injection payloads continued to reproduce the broader self-propagating attack class through July 28, following a 144-day coordinated disclosure process.
Microsoft’s mitigations reportedly blocked specific proof-of-concept prompt formulations. However, they did not fully resolve the architectural problem: large language models must process document contents while reliably distinguishing untrusted data from authoritative instructions. This same boundary failure underpins many indirect prompt injection attacks across AI assistants.
Organizations should treat externally sourced documents as untrusted material when supplying them to Copilot, even if they appear to come from legitimate partners or websites.
Security teams should also require careful review of documents generated or edited by Copilot before distribution, especially for financial, legal, operational, and executive materials.
Monitoring for anomalous hidden text, unexpected formatting, and unexplained content changes can help reduce exposure. At the same time, vendors work toward stronger model-level and product-level defenses.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
