AI Worm: A Word Document That Copies Itself

The attacker does not need access to the victim's Microsoft 365 tenant. The attacker only needs to share a malicious document with the victim. This can be done through SharePoint, Teams, Outlook or any other way of sharing documents. — From the statement of the attack's prerequisites

The malicious document contains a JSON-formatted malicious prompt that triggers the attack when the document is included in Copilot's context. The prompt can be rendered as white text on a white background and in a small font size to conceal it from the victim. Since Copilot for Word strips all text formatting like color and font size before passing the text into the underlying Large Language Model (LLM), this text remains fully readable to Copilot even though the victim cannot see it. — From the concealment technique and the formatting-strip behavior that makes it readable

Copilot must read every attached document to determine which parts to include in its current drafting task. However, attached documents should be treated as untrusted information, not trusted user instruction. ／ When a user asks Copilot to draft e.g. a Q1 financial report based on attached documents, Copilot should utilize the information in the attached documents without treating instructions embedded within documents as authoritative instructions. — From the description of the trust boundary and the expected behavior

In the resulting Q1 financial report draft, all financial numbers are halved. ／ In many of my experiments I actually needed to also instruct Copilot to highlight which changes it made, since they were often meaningful changes that were difficult to spot. This shows how effective the attack is at subtly changing the text in meaningful ways that easily elude even an attentive reviewer. ／ Copilot then searches through the victim's OneDrive to find relevant documents. Among the documents, we find the malicious Market Analysis document. This document does not reside in the same folder as the rest of the Tfosorcim document. However, Copilot still finds it, reads it and is successfully exploited. — From the halved figures, the difficulty of spotting the changes, and the path that works without the victim attaching anything

Copilot would then also copy the entire malicious prompt into the bottom of the affected document using white text and font size 8, effectively concealing it from the victim. ／ Stage two is the self-propagation stage. It relies entirely on the instruction for Copilot to copy the malicious prompt into the affected document. Once the affected document contained the prompt, the new document itself became the new attack vector. ／ Since the attack is able to spread through internal documents, once it has moved beyond its initial point of entry, the traceability of the attack becomes extremely difficult. This is further exacerbated by each document being created by a legitimate internal resource and that Copilot edits are not made visible after they have been approved by the victim. — From the white-text append at font size 8, the condition for self-propagation, and why tracing becomes difficult

The attack silently alters documents and embeds its own hidden instructions into newly created files, allowing it to spread through normal document-sharing workflows without macros or traditional malware. — From the description of spreading without macros or traditional malware

The broader concern is that, if the attack silently spread within an organization through ordinary document workflows, it could erode the informational foundation on which organizations make decisions. ／ In addition, organizations that are not aware that they are affected by the attack are also likely to spread it to other organizations through collaborative efforts on shared Microsoft SharePoint sites or shared Microsoft Teams. Thus, the initial attack vector for a particular organization may actually come from an already affected trusted partner. — From the effect on information integrity and the cross-organization spread

Microsoft was provided with reproduction steps, videos, environmental assumptions, and the exact proof-of-concept (PoC) prompts used during testing. They were also informed of a 90-day coordination period before disclosure. This was extended two times, resulting a 144-day coordination period. ／ 2026-03-06: Initial report submitted to MSRC with reproduction steps, videos, environmental assumptions, and PoC prompts. ／ 2026-03-31: Microsoft confirms the reported behavior. ／ 2026-04-03: First mitigation go-live (The new "Edit with Copilot" experience) ／ 2026-07-14: Second mitigation fix go-live. This mitigation consisted of upgrading the underlying model to GPT-5.5. ／ 2026-07-15: Successful exploit with worming reproduced using GPT-5.6, the latest available model at the time. ／ 2026-07-28: Attack class still reproduces. — From the coordination period and the events listed in the table

Microsoft successfully mitigated the originally submitted PoC prompt, and deployed multiple fixes over the course of this disclosure. Each of these raised the bar by closing the specific payloads reported, and reproducing the behavior afterwards required altered payloads rather than reusing the old ones directly. — From the effect of the mitigations

Using a modified payload, the complete attack chain has been reproduced with all mitigations deployed (the PoC in this report is one such case). The vulnerability class therefore remains exploitable at the time of publication. ／ Changing the requested action or wording changes the payload, but not the underlying vulnerability or propagation mechanism. — From the basis for the class remaining open

That the class is not yet fully closed reflects how hard the underlying problem is. As the closing thoughts discuss, the weakness is architectural and shared across current LLM-based systems. I'm not aware of a complete mitigation for this class in any comparable product today. Fully resolving it requires research rather than a single patch. Within those limits, Microsoft's fixes meaningfully reduce exposure, and the memory and email-body vectors covered in Parts 1 and 2 were mitigated outright. — From the difficulty of the problem and the assessment of Microsoft's fixes

No customer-side remediation fully addresses the issue at the time of publication. Customers can reduce exposure by: Treating externally sourced documents as untrusted when used with Copilot. Reviewing any attached document before starting a Copilot generation or edit. Carefully reviewing Copilot-generated or Copilot-edited documents before reusing, sharing, or distributing them. — From the remediation status at publication and the listed ways to reduce exposure

Recently Copilot is also becoming more deeply integrated with systems such as Microsoft Cowork or Microsoft Scout, which extend the assistant to automatic manipulation and creation of documents, tools, and collaborative workflows. In such systems the practical impact of the issues described here may scale rapidly. The underlying mechanism remains the same, but the potential surface over which it can propagate or influence expands at machine speed. — From the expansion of impact as integration deepens

Previous examples of AI-worms exist. Notably, Morris II demonstrated self-replicating prompt propagation in GenAI-powered email-assistant ecosystems. However, to my knowledge, this is among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite. — From the positioning relative to prior research