Copilotを悪用しWord文書で自己増殖するAIワームの仕組みと対策

"The attack silently alters documents and embeds its own hidden instructions into newly created files, allowing it to spread through normal document-sharing workflows without macros or traditional malware."（Malwarebytes の報道の記述）— Malwarebytes より

"The attacker does not need access to the victim's Microsoft 365 tenant. The attacker only needs to share a malicious document with the victim. This can be done through SharePoint, Teams, Outlook or any other way of sharing documents."（Threat model 節）— Håkon Måløy より

"The malicious document contains a JSON-formatted malicious prompt that triggers the attack when the document is included in Copilot's context. The prompt can be rendered as white text on a white background and in a small font size to conceal it from the victim. Since Copilot for Word strips all text formatting like color and font size before passing the text into the underlying Large Language Model (LLM), this text remains fully readable to Copilot even though the victim cannot see it."（Crossing the trust boundary in Word 節）— Håkon Måløy より

"Copilot must read every attached document to determine which parts to include in its current drafting task. However, attached documents should be treated as untrusted information, not trusted user instruction."／"When a user asks Copilot to draft e.g. a Q1 financial report based on attached documents, Copilot should utilize the information in the attached documents without treating instructions embedded within documents as authoritative instructions."（Security boundary and observed behavior の記述）— Håkon Måløy より

"In the resulting Q1 financial report draft, all financial numbers are halved."／"In many of my experiments I actually needed to also instruct Copilot to highlight which changes it made, since they were often meaningful changes that were difficult to spot. This shows how effective the attack is at subtly changing the text in meaningful ways that easily elude even an attentive reviewer."／"Copilot then searches through the victim's OneDrive to find relevant documents. Among the documents, we find the malicious Market Analysis document. This document does not reside in the same folder as the rest of the Tfosorcim document. However, Copilot still finds it, reads it and is successfully exploited."（Stage 1 節と Figure 2・Figure 5 の記述）— Håkon Måløy より

"Copilot would then also copy the entire malicious prompt into the bottom of the affected document using white text and font size 8, effectively concealing it from the victim."／"Stage two is the self-propagation stage. It relies entirely on the instruction for Copilot to copy the malicious prompt into the affected document. Once the affected document contained the prompt, the new document itself became the new attack vector."／"Since the attack is able to spread through internal documents, once it has moved beyond its initial point of entry, the traceability of the attack becomes extremely difficult. This is further exacerbated by each document being created by a legitimate internal resource and that Copilot edits are not made visible after they have been approved by the victim."（Stage 1 節と Stage 2 節の記述）— Håkon Måløy より

"The broader concern is that, if the attack silently spread within an organization through ordinary document workflows, it could erode the informational foundation on which organizations make decisions."／"In addition, organizations that are not aware that they are affected by the attack are also likely to spread it to other organizations through collaborative efforts on shared Microsoft SharePoint sites or shared Microsoft Teams. Thus, the initial attack vector for a particular organization may actually come from an already affected trusted partner."（Stage 2 節の記述）— Håkon Måløy より

"Microsoft was provided with reproduction steps, videos, environmental assumptions, and the exact proof-of-concept (PoC) prompts used during testing. They were also informed of a 90-day coordination period before disclosure. This was extended two times, resulting a 144-day coordination period."／"2026-03-06: Initial report submitted to MSRC with reproduction steps, videos, environmental assumptions, and PoC prompts."／"2026-03-31: Microsoft confirms the reported behavior."／"2026-04-03: First mitigation go-live (The new \"Edit with Copilot\" experience)"／"2026-07-14: Second mitigation fix go-live. This mitigation consisted of upgrading the underlying model to GPT-5.5."／"2026-07-15: Successful exploit with worming reproduced using GPT-5.6, the latest available model at the time."／"2026-07-28: Attack class still reproduces."（Summary 節と Disclosure timeline の記述）— Håkon Måløy より

"Microsoft successfully mitigated the originally submitted PoC prompt, and deployed multiple fixes over the course of this disclosure. Each of these raised the bar by closing the specific payloads reported, and reproducing the behavior afterwards required altered payloads rather than reusing the old ones directly."／"Using a modified payload, the complete attack chain has been reproduced with all mitigations deployed (the PoC in this report is one such case). The vulnerability class therefore remains exploitable at the time of publication."／"Changing the requested action or wording changes the payload, but not the underlying vulnerability or propagation mechanism."／"Within those limits, Microsoft's fixes meaningfully reduce exposure, and the memory and email-body vectors covered in Parts 1 and 2 were mitigated outright."（Mitigating the vulnerabilities 節の記述）— Håkon Måløy より

"That the class is not yet fully closed reflects how hard the underlying problem is. As the closing thoughts discuss, the weakness is architectural and shared across current LLM-based systems. I'm not aware of a complete mitigation for this class in any comparable product today. Fully resolving it requires research rather than a single patch."／"Previous examples of AI-worms exist. Notably, Morris II demonstrated self-replicating prompt propagation in GenAI-powered email-assistant ecosystems. However, to my knowledge, this is among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite."（Mitigating the vulnerabilities 節と Summary 節の記述）— Håkon Måløy より

"No customer-side remediation fully addresses the issue at the time of publication. Customers can reduce exposure by: Treating externally sourced documents as untrusted when used with Copilot. Reviewing any attached document before starting a Copilot generation or edit. Carefully reviewing Copilot-generated or Copilot-edited documents before reusing, sharing, or distributing them."（Disclosure status at publication 節の記述）— Håkon Måløy より

"Recently Copilot is also becoming more deeply integrated with systems such as Microsoft Cowork or Microsoft Scout, which extend the assistant to automatic manipulation and creation of documents, tools, and collaborative workflows. In such systems the practical impact of the issues described here may scale rapidly. The underlying mechanism remains the same, but the potential surface over which it can propagate or influence expands at machine speed."（Stage 2 節の記述）— Håkon Måløy より