Intel / article

AI Worming through Word

Source: simonwillison.net
Author: Simon Willison
Date: Published Jul 29, 2026

Context

A July 2026 security report by researcher Håkon Måløy describes hidden instructions spreading through Microsoft Copilot for Word workflows. An attacker places hidden instructions in a document that is later used as source material; Copilot may treat them as part of the user's request and manipulate the document being drafted. Copilot may also copy the hidden instructions into the document it produces, turning that output into a new carrier. If the carrier is used in another Copilot-assisted workflow, the instructions can trigger again and propagate without the original document. The crucial dependency is repeated use of affected documents in AI-assisted drafting. Primary disclosure.

Key takeaways · AI-distilled

The worm works because Copilot copies the hidden instructions into the document it writes. That output file becomes a new carrier, so the payload keeps spreading through later Copilot workflows with the attacker's original document nowhere in sight.
Hidden white-on-white instructions in documents are old; job applicants already do it. The new part is a payload written to reproduce itself, which turns a one-shot into something that propagates.
Microsoft had 144 days after responsible disclosure and still has no mitigation covering the full class of attack — evidence that patching individual injection paths does not close the category.

Terms in this piece · Glossary

prompt injection — An attack that hides instructions in content an AI will read — a webpage, email, or document — tricking it into following the attacker instead of the user.

Key quotes

“Copilot may then also copy the hidden instructions into the resulting document, turning that document into a new carrier.”
Håkon Måløy

“We've seen plenty of hidden white-on-white text before - the kids are using it in their job applications now - but this is the first one I've seen that deliberately copies instructions to self-replicate itself.”

“It was responsibly disclosed to Microsoft who then had 144 days to work on a fix, but so far (unsurprisingly) there's no mitigation that covers the full class of attack.”

Read the source simonwillison.net