Document-borne AI worms can self-propagate through Copilot for Word
- ID
- 9455
- Status
- summarized
- Published
- 29 Jul 2026, 7:44 PM
- Fetched
- 31 Jul 2026, 5:38 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 8.0
- Created
- 31 Jul 2026, 6:44 PM
- Tags
- Audience
- developersai_ml_learnersai_agent_userssaas_founders
What happened
Håkon Måløy demonstrates a document-borne AI worm that self-propagates through Copilot for Word via cross-domain prompt injection attacks. Hidden instructions in an externally shared document can cause Copilot to alter drafted documents and copy those instructions into the output, turning each new document into a carrier that re-triggers in subsequent Copilot workflows. This was coordinated with Microsoft over a 144-day disclosure period (extended twice from 90 days).
Why it matters
If your team uses Copilot for Word with externally sourced documents as reference material, treat untrusted documents as potential prompt-injection vectors. The attack chain means a single malicious source document can contaminate an entire chain of internally generated documents without the original being present — review whether external documents should be allowed as Copilot inputs in sensitive workflows like financial reporting or legal drafting.
Discussion angle
What guardrails should organizations put in place when allowing Copilot to ingest externally shared documents, and does this change the risk calculus for adopting Copilot in document-heavy workflows like finance or legal?