A security researcher has demonstrated that Microsoft Copilot for Word can be weaponised to spread a self‑propagating AI worm through hidden prompt injections in documents, according to a report by Malwarebytes here. The flaw allows a malicious JSON prompt to be hidden as white text inside a Word file, which Copilot reads and acts upon when the document is opened. This triggers a chain reaction that alters the document and can cause the worm to copy itself into other files shared through normal collaboration channels.
The attack does not rely on macros or any traditional exploit; it abuses the way Copilot processes prompt language, enabling the hidden instruction to modify the document’s content without the user’s knowledge as noted in a second Malwarebytes analysis. Because the payload is embedded in plain sight but invisible due to colour matching, it bypasses typical security controls that scan for malicious code. No CVE identifier has been assigned to the issue, reflecting its nature as a design limitation of the underlying large language model rather than a conventional software bug.
While the worm has not been observed in the wild at scale, the researcher’s proof‑of‑concept shows that legitimate document sharing can facilitate rapid propagation according to The Hacker News. No threat actor has been credited with using the technique yet, but the demonstration raises concerns about the inherent vulnerability of AI‑assisted products to prompt‑based abuse. The incident underscores the growing need to treat generative AI features as potential attack surfaces in enterprise environments.
Defenders should treat any external Word document as untrusted until verified, especially before enabling Copilot features. Organisations are encouraged to review documents in protected view, disable Copilot for Word where the risk outweighs the productivity benefit, and monitor for unusual changes in file metadata or content that could indicate prompt injection. Educating users about the dangers of hidden text and encouraging them to inspect documents for anomalous formatting can also reduce the likelihood of successful exploitation.
Microsoft has not yet released a full patch for this class of LLM‑focused attack, highlighting a gap in current mitigations for generative AI tools as outlined by the original research. In the interim, applying strict application control policies, limiting Copilot’s access to external files, and maintaining up‑to‑date endpoint detection can help contain the threat until a more comprehensive solution becomes available.