Index — Latest Intelligence

Intel

AI Worming through Word | VibeLeaderboard

← All Intel

Intel / article

AI Worming through Word

Source: Simon Willison
Author: Simon Willison
Date: Published Jul 29, 2026

Key takeaways · AI-distilled

The worm works because Copilot copies the hidden instructions into the document it writes. That output file becomes a new carrier, so the payload keeps spreading through later Copilot workflows with the attacker's original document nowhere in sight.
Hidden white-on-white instructions in documents are old; job applicants already do it. The new part is a payload written to reproduce itself, which turns a one-shot into something that propagates.
Microsoft had 144 days after responsible disclosure and still has no mitigation covering the full class of attack — evidence that patching individual injection paths does not close the category.

Terms in this piece · Glossary

prompt injection — An attack that hides instructions in content an AI will read — a webpage, email, or document — tricking it into following the attacker instead of the user.
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.

Why it matters

A working self-replication path for prompt injection changes the threat model for any that reads user-supplied documents.

Key quotes

“Copilot may then also copy the hidden instructions into the resulting document, turning that document into a new carrier.”
Håkon Måløy

“We've seen plenty of hidden white-on-white text before - the kids are using it in their job applications now - but this is the first one I've seen that deliberately copies instructions to self-replicate itself.”

“It was responsibly disclosed to Microsoft who then had 144 days to work on a fix, but so far (unsurprisingly) there's no mitigation that covers the full class of attack.”

Read the source ↗simonwillison.net