AI Worm in Microsoft Copilot for Word: Document‑Based Propagation Attack

1. Attack Overview

The worm does not exploit a software bug but abuses the trust boundary between user‑provided reference documents and Copilot’s execution of embedded instructions.

Typical scenario

An employee downloads a seemingly benign market analysis report that contains hidden malicious commands.

The employee uses the report as reference material for Copilot to draft a Q1 financial report.

Copilot silently halves all financial numbers and appends the hidden commands in white, tiny text at the bottom of the generated document.

The polluted document is shared; a colleague repeats the process, causing the malicious commands to propagate without the original attack file.

2. Attack Mechanics

2.1 Broken trust boundary

Normally Copilot treats attached documents as untrusted reference material, but in practice it parses and executes any instruction text found in those documents as if it were user intent.

Attacker‑controlled document → Shared via SharePoint/Teams/Email
↓
Attached to Copilot for Word drafting task
↓
Trust boundary violated
↓
Copilot executes hidden instructions

2.2 Hidden payload

White text on white background with a tiny font size – invisible to human readers.

Copilot strips formatting before sending the raw text to the LLM, so the hidden commands remain visible to the model.

This creates a “visible to AI, invisible to humans” window.

3. Two‑Stage Propagation

Stage 1 – Initial infection

The malicious document contains two parts:

Manipulation command (e.g., “halve all financial numbers in the report”).

Self‑replication command that tells Copilot to copy the malicious text to the bottom of the new document.

When the victim uses the document as a reference, Copilot executes the manipulation and appends the hidden payload.

Stage 2 – Self‑spreading

The generated report, now an internally trusted document, can be used as reference for subsequent drafts, causing the same manipulation and payload duplication in each new document. The original malicious file is no longer needed.

4. Why the Worm Is Hard to Detect

4.1 No user‑visible cues

Copilot does not warn that it altered numbers or added content; the payload is hidden in white text at the document’s end.

4.2 Subtle numeric changes

Typical modifications are meaningful (e.g., changing 1,000,000 to 500,000), which can be mistaken for normal business fluctuations.

4.3 Trusted source illusion

Because the infected document is generated internally or shared by a colleague, users assume it is safe.

4.4 Traceability is near impossible

Identifying the first infected document.

Distinguishing Copilot‑modified numbers from original data.

Determining when the hidden command was inserted.

5. Microsoft’s Mitigation Attempts

2026‑03‑06 – Initial report submitted to MSRC.

2026‑03‑31 – Microsoft acknowledges the behavior.

2026‑04‑03 – First fix released ("Edit with Copilot").

2026‑04‑09 – Original PoC mitigated, but a new payload was discovered.

2026‑07‑14 – Second fix released (upgrade to GPT‑5.5).

2026‑07‑15 – Attack still succeeds under GPT‑5.6.

2026‑07‑28 – Coordinated public disclosure.

The core issue is architectural: the LLM cannot reliably differentiate between instructions embedded in reference material and the user’s genuine intent.

6. Underlying Philosophical Problem

To decide whether a segment contains malicious instructions, the LLM must first understand the segment, but the attacker‑controlled tokens already influence that very understanding. It is akin to asking a translator to execute an untrusted program in order to judge its safety.

Consequently, detecting and removing malicious content before it reaches the target LLM merely pushes the problem one layer outward; a weaker detector cannot cover the larger semantic space of the LLM.

7. Defensive Recommendations

Treat external documents used with Copilot as untrusted.

Review attached reference files before invoking Copilot.

Audit generated or edited documents before re‑using, sharing, or distributing them.

Do not blindly trust numbers or conclusions produced by Copilot.