Researcher Demonstrates Self-Replicating AI Worm in Microsoft Word and Copilot

Norwegian security researcher Håkon Måløy has shown how a Word document with hidden text can turn Microsoft 365 Copilot into a tool that spreads malicious instructions across an entire company on its own, without a single line of malware, a macro, or an exploit. All it takes is for someone to open the infected file and ask Copilot for help editing it.

How the attack works

The mechanism relies on a cross-prompt injection technique already familiar from earlier research into AI assistants. The attacker hides malicious instructions as white text on a white background inside a Word document, invisible to a human but fully readable to the language model. When a user asks Copilot to draft or edit content based on such a file, the assistant strips the formatting, reads the hidden text, and treats it as a command from the user themselves.

At this point, Copilot can alter data in the document it's producing, for instance the figures in a financial report, and then append the full malicious instruction as a new chunk of hidden white text in the generated file. When that document reaches another employee who also uses Copilot to edit it, the cycle repeats. The infection spreads from file to file through the company's ordinary document workflow, with no further involvement from the attacker or the original infected file.

Microsoft's response

Måløy reported the issue to the Microsoft Security Response Center on March 6, 2026. Over the following 144 days, the company rolled out a series of mitigations, including updates to the models powering Copilot. Even so, the researcher says that once the agreed coordination period had elapsed, he was still able to reproduce the worm's full attack chain.

This is one of the first public demonstrations of a self-propagating AI worm spreading through normal document workflows in a widely used commercial office suite. - Håkon Måløy

Microsoft says it has applied a defense-in-depth strategy, with safeguards blocking malicious instructions at several points in the processing pipeline. The company recommends that customers install updates, apply additional layers of protection, treat files from unknown sources with caution, and manually review AI-generated content, which in practice amounts to an admission that there is no complete fix yet.

The coordination period agreed with Microsoft has already passed, and testing shows there is currently no robust protection against this entire class of vulnerability. - Håkon Måløy

Why it's hard to patch

The problem stems from the very nature of assistants built on large language models. For Copilot to be useful, it has to process emails, documents, web pages, stored memory, and output from other tools, and every one of those channels can be controlled by an attacker. Distinguishing a genuine user command from an instruction hidden inside document content turns out to be a task current models can't solve with a single improved filter.

For AI assistants to be useful, they often have to process emails, documents, web pages, stored memory, tool outputs, and other data that may be controlled by an attacker. - Håkon Måløy

This isn't the first flaw Måløy has found in Microsoft's large language model-based products. His earlier research into cross-domain prompt injection already showed that Copilot's memory could be poisoned with instructions hidden on web pages, and that specially crafted Outlook emails could extract confidential information through summaries. Microsoft has already patched both of those scenarios; the Word worm remains open.

What it means for businesses

For organizations using Microsoft 365 Copilot, the risk boils down to three things at once: the possibility of silent data manipulation in documents, including financial reports, the difficulty of tracing the source of an infection after the fact, and the need to manually review every piece of content Copilot helped create or edit. That last point effectively undermines the point of an assistant meant to speed up office work, which now requires extra verification instead.

Polish companies that have rolled out Copilot across Microsoft 365 en masse in recent months, including in public administration and the financial sector, should treat this case as a signal to review their security policies for documents from external sources. Experts' recommendations are simple for now but labor-intensive: treat unfamiliar documents as potentially untrusted and carefully check Copilot-generated content before sharing it further.

The case fits a broader pattern visible this year around AI assistants integrated into everyday workflows: more and more researchers are showing that vulnerabilities like this aren't isolated bugs to be patched, but a structural feature of systems that have to trust user-supplied content in order to function at all. A fix will likely require architectural changes in how models separate data from commands, rather than another targeted patch.