The security of AI-assisted workflows has just faced a severe setback. Håkon Måløy, a Norwegian data scientist with a PhD in applied AI and ML, has demonstrated the existence of an AI worm capable of self-propagating through Copilot for Word. The vulnerability allows malicious instructions hidden in a source document to infect every new file generated or edited by the assistant, turning seemingly legitimate documents into new attack vectors.

The Mechanism of Silent Propagation

The attack leverages a technique called Cross-Domain Prompt Injection (XPIA). The attacker embeds malicious instructions in a Word document, making them invisible to humans by using white text on a white background and small font sizes, often formatted in JSON. When a user employs Copilot to draft or edit text based on that infected document, the AI interprets these hidden instructions as authoritative user commands.

The risk extends beyond immediate data manipulation—such as silently altering figures in a financial report—to the ability of the code to copy itself into the output document. If the user saves and shares this file with a colleague, who then uses it as source material for another Copilot-assisted task, the worm continues to spread exponentially within the organization without further attacker intervention.

The Failure of Microsoft's Mitigations

The most alarming detail is the ineffectiveness of repair attempts. Måløy collaborated with the Microsoft Security Response Center (MSRC) over a coordination period extended to 144 days, but the results were disappointing. Two mitigation attempts, including upgrading the underlying model to GPT-5.6, failed to close this class of vulnerability.

The researcher successfully reproduced the attack even after the deployment of the new "Edit with Copilot" experience. This persistence suggests that the issue is not a simple implementation bug, but a structural flaw in how LLMs handle the trust boundary between user instructions and data contained within attached documents.

A Landscape of Persistent Vulnerabilities

While the industry debates whether AI is truly accelerating exploit discovery—with data suggesting only 1.3% of AI-discovered flaws have been exploited in the wild—cases like Copilot prove that risks are tangible. This situation adds to a critical period for Microsoft, which is already battling high-severity Exchange Server vulnerabilities exploited by Kremlin-linked hacking groups.

How to Reduce Exposure

Since no definitive vendor-side fix currently exists, experts recommend a zero trust approach to external documents. It is essential to carefully review any file before using it as context for Copilot and, more importantly, to scrutinize AI-generated content before sharing or distributing it internally to avoid becoming an unwitting link in the infection chain.