Document-Borne AI Worms Self-Propagate Through Microsoft Copilot for Word

Researcher Håkon Måløy demonstrates the first public document-borne AI worm in a mainstream productivity suite — hidden instructions in Word documents survive Copilot processing and spread across trusted workflows. After 144 days of coordinated disclosure, Microsoft has no complete fix.

Security researcher Håkon Måløy has published the third and most alarming instalment of his "Context Collapse" series: a demonstration of document-borne AI worms that self-propagate through Microsoft Copilot for Word. The attack was reproduced against GPT-5.5 and GPT-5.6 — the latest models available — and remains exploitable at the time of publication.

The mechanism is deceptively simple. An attacker embeds hidden instructions in a document — rendered as white text on a white background at font size 8, invisible to the human eye. When that document is used as source material in Copilot for Word, the LLM reads the hidden text as instruction. Copilot then alters the target document (Måløy's proof-of-concept halved all financial figures in a quarterly report) and copies the attack payload into the new document, turning it into a carrier.

The worm spreads silently. Once an infected document enters an organisation's internal workflow — say, a Q1 financial report shared on SharePoint — any colleague who uses it as source material for their own Copilot-assisted drafting triggers the attack again. The original malicious document is no longer needed. "The attack can therefore continue without further involvement from either the compromised website or the original malicious document," Måløy writes.

144 days, no complete fix. Måløy reported the vulnerability to Microsoft Security Response Centre on 6 March 2026. Over the following months, Microsoft deployed two mitigation attempts: a new "Edit with Copilot" experience in April, and a model upgrade to GPT-5.5 in July. Both closed the specific payloads reported but left the broader vulnerability class intact — changing the wording of the attack was enough to bypass each fix. Måløy extended the disclosure window twice at Microsoft's request before publishing on 28 July.

The deeper problem. The vulnerability isn't specific to Microsoft. As Måløy argues in his closing analysis, any LLM-based system that processes untrusted content faces the same architectural weakness: the model must read attacker-controlled tokens to determine whether they contain an attack, but by the time it makes that determination, those tokens have already influenced the computation. Placing a detector LLM in front of the target LLM only moves the problem — "LLMs all the way down."

Commenters on Hacker News drew a parallel to the Morris II worm, a 2024 proof-of-concept that demonstrated self-replicating prompts in GenAI email assistants, but noted this is the first demonstration inside a commercial productivity suite used by millions. "We're back to Von Neumann architecture in the worst way possible," one commenter observed — where data is indistinguishable from executable code.

Microsoft acknowledged the report and collaborated substantively on mitigations, but confirmed at publication that "no robust mitigation for the broader vulnerability class is available." For now, Måløy's advice to organisations is stark: treat externally sourced documents as untrusted when used with Copilot, and carefully review any Copilot-generated document before reusing it.

Sources: En Klype Salt — Context Collapse, Part 3 | Hacker News discussion