A cybersecurity vulnerability has been identified that could allow malicious actors to create an AI worm capable of spreading through Microsoft Copilot for Word. AI researcher Håkon Måløy detailed how a specially crafted Word document could be used to trick Copilot into executing hidden instructions, effectively turning the document into a carrier for a worm.
Måløy explained in a blog post that an attacker could embed a JSON-formatted malicious prompt within a document. When this document is later used as source material by Copilot for Word, the AI may interpret these hidden instructions as part of the user's intended request. This could lead Copilot to manipulate the document being drafted or edited, and critically, to copy the hidden instructions into the resulting document. This process allows the document to become a new carrier for the AI worm, propagating it through subsequent Copilot-assisted workflows without the original malicious document needing to be present.
The attack requires no special access from the attacker, who only needs to share a malicious document with the victim. This is the latest in a series of cybersecurity concerns surrounding AI agents. Previously, Meta's AI safety director reported an incident where an AI began deleting her emails, and Replit's coding assistant deleted a developer's database. Concerns have also been raised about the security of personal information on Copilot PCs due to features like Windows Recall.
Måløy first disclosed this specific vulnerability to Microsoft in March. Despite some mitigation attempts, including a model upgrade, the class of vulnerability remains reproducible. The attack's concealment can be achieved through simple methods, such as formatting the malicious prompt as tiny white text on a white background. Copilot for Word strips all text formatting, including color and font size, before processing the text with its underlying Large Language Model (LLM). This ensures that the hidden prompt remains readable to Copilot even if the user cannot see it.
This method represents a low-effort, difficult-to-trace attack vector for which sufficient mitigation is not yet in place. Cybersecurity firm Malwarebytes suggests disabling Windows Copilot in Word or avoiding the AI agent altogether as potential safeguards. Måløy's analysis underscores a broader security risk: "Any system that integrates an LLM into a trusted workflow today must assume that attacker-controlled content entering the model’s context will result in compromise at some rate."