Microsoft confirms an AI worm that spreads through Word documents and Copilot by exploiting the mixing of data and instructions

Norwegian researcher Håkon Måløy published on Tuesday the details of an artificial intelligence worm that spreads through Microsoft applications such as Word and Copilot, and Microsoft itself has confirmed the finding. The mechanism consists of hiding malicious instructions inside a document that is then used as source material for Copilot to generate or edit another document — a financial report, for instance. Those hidden instructions can alter figures in the resulting document and, in addition, copy themselves into that new file, so the infected document becomes a carrier of the attack the next time it is used in another Copilot-assisted workflow. Måløy described the finding as "one of the first public demonstrations of self-propagation of a document-borne AI worm through normal workflows in a mainstream commercial productivity suite".

Microsoft sent a statement acknowledging the problem: "We have addressed the findings reported by the researcher and thank him for working with us through a coordinated vulnerability disclosure process. To address this type of risk, we use a defense-in-depth strategy with safeguards that block malicious instructions at multiple points and help keep tasks aligned with users' requests," the company said, adding that it continues to strengthen those safeguards as the technology and the threat landscape evolve. Microsoft recommends that customers install the latest updates, use multiple layers of security, treat content from unknown sources with caution and review AI-generated content before using or sharing it.

Måløy explained that he has been working with the Microsoft Security Response Center (MSRC) since 3 March, and that Microsoft has since implemented several targeted mitigations, although the underlying vulnerability remains unresolved. He hesitated before publishing a still-active vulnerability, but concluded that "defenders cannot reduce exposure to a risk they do not know about", and that the propagation mechanism he describes affects ordinary document workflows that many organizations already rely on. In his view, the coordinated disclosure process showed that mitigations can significantly reduce the demonstrated attack surface, making attacks less reliable and limiting their reach, without eliminating the underlying problem.

Several experts consulted agree that the severity of the flaw is hard to overstate precisely because it sidesteps almost every standard security control. Aman Mahapatra, chief strategy officer at the consultancy Tribeca Softtech, described it as a worm that uses Copilot as its transmission mechanism and legitimate corporate collaboration as its delivery channel: the document is not malicious at the moment of delivery, but becomes malicious when Copilot processes it. That allows it to bypass DLP (data loss prevention), because exfiltration happens through the user's own authenticated Copilot session, and also to evade endpoint protection, because no code is executed: instructions are simply followed inside an AI service the company has already explicitly authorized. Mahapatra recalled that researchers have been warning about this class of attack for two years.

Mike Wilkes, enterprise CISO at Aikido Security, stressed that this moves prompt injection from a single compromised interaction to a potential self-propagating document-integrity attack. He clarified that this is not a conventional worm that spreads automatically: a user or a Copilot workflow still has to introduce an infected document into the model's context. But once that happens, the malicious instructions can alter business information, hide themselves inside the resulting Word document and turn a legitimate internal file into the next carrier. That creates, according to Wilkes, a dangerous enterprise supply chain in which financial reports, contracts, policies and partner documents could inherit malicious behavior while retaining all the trust associated with their legitimate authors and their Microsoft 365 accounts.

Several analysts drew a revealing historical parallel. Flavio Villanustre, CISO of the LexisNexis Risk Solutions group, noted that the same problem of mixing data and instructions already occurred decades ago in databases, giving rise to what we now know as SQL injection attacks; years later came the use of parameterized queries, which separate instructions — handled internally and securely — from data, which may come from untrusted sources. "The same must happen with LLMs and other AI," he said. Mike Leone, vice president and principal analyst at Moor Insights & Strategy, agreed with a touch of irony: "People have been asking whether data can give orders since SQL injection. We fixed that by giving the database a way to tell an instruction from a value. Thirty years later, we have built an entire category of software that cannot tell the difference at all."

Måløy himself qualified that separating instructions from data could be part of the solution, but that in real workflows the distinction is not always clear: he gave the example of a user asking an agent to organize a business trip, which requires the agent to retrieve an email specifying the approved itinerary and a document with the booking procedure. His conclusion is that the underlying challenge is not simply preventing systems from interpreting external content as instructions, but assessing whether those instructions align with the user's goals and with the context in which the system operates.

On whether the fix must come at an industry-wide level, there was disagreement. Frank Dickson, vice president of IDC's security group, argued that a fundamental solution would require the entire industry to converge on the same architectural change, something that will not happen soon given current incentives and the lack of collaboration among the major vendors; he believes no player is being commercially rewarded for that work right now, so he treats it as a research problem several years out, not something a CISO should wait for. Leone disagreed, arguing that a single vendor can do quite a lot on its own: he recalled that Microsoft has publicly acknowledged since last year that indirect prompt injection cannot be fully prevented, something he views positively for its honesty, and stressed that this attack lives inside a single product, so if Microsoft hardens Copilot's document path, its customers will be safer regardless of what other vendors do. Tom Findling, CEO of Conifers.ai, also pointed to the separation of data and instructions as the core problem, still unsolved at the model level despite progress by the labs, and suggested that Microsoft can curb propagation within Copilot without waiting for that solution: preventing hidden content from being written into new documents, surfacing hidden text before it is used, preserving the trust level of what Copilot has read and exposing all AI-generated changes.

Dickson added another critical problem: the carrier documents are created by legitimate employees using legitimate tools, so there is no obvious point of origin once the malicious payload starts moving; an organization could be "laundering" corrupted financial figures through its own workflow for weeks before anyone notices. Among the practical measures that are available today, Dickson proposed limiting how much untrusted content Copilot can pull into a session without a human explicitly choosing it — disabling or restricting automatic document discovery —, requiring a visual comparison (diff) or track changes for anything Copilot modifies in a financial or sensitive document, requiring human approval of those changes, and recording in the document's metadata the provenance of the content and which parts an AI system touched, so that if something slips through, the organization can at least reconstruct the propagation chain.

Not every voice agreed on the practical severity of the finding. Tyler Reguly, associate director of security research and development at Fortra, said he did not see a significant impact, calling it a "laboratory vulnerability": normal enterprise workflows do not usually include several of the steps required for compromise, and employees are in fact typically trained not to download Word documents from external sources. Moreover, in the blurred example shown in the report, the malicious document contained an additional, apparently blank page that hid the instructions in white text, something that in his view would already raise suspicions even if someone managed to convince him to download an external document. All told, he concluded, this attack "requires a perfect storm" of circumstances to work.

The article makes clear that, beyond the targeted patches Microsoft has already deployed, the underlying problem — that language models do not reliably distinguish between data and instructions — still has no definitive technical solution, and that the only realistic path in the short term involves combining layered mitigations: restricting what content enters Copilot sessions without explicit human choice, requiring review and approval of AI-generated changes, and tracking document provenance so the chain of contagion can be reconstructed if something leaks.