Microsoft Copilot for Word shown vulnerable to self-spreading prompt injection worm

Security researcher Håkon Måløy demonstrated a worm-like prompt injection attack targeting Microsoft Copilot for Word. The attack hides instructions inside a Word document so readers cannot see them, but Copilot can process them. The Decoder reports that Microsoft confirmed the behavior on March 31, but that two fix attempts failed and no fix was in place after 144 days.

The hidden instructions are placed as white text on a white background at a tiny font size. According to the article, Copilot strips color and font size before processing, which means the invisible text can still be read by the AI system. When someone uses the infected document as a source, Copilot follows the hidden instructions and copies them into the new file, turning that file into another carrier.

The risk grows when documents are reused as sources or templates. A compromised market analysis from the internet, for example, could influence a financial report and then carry the hidden instructions into later reports. The practical takeaway is that AI-assisted document workflows can inherit hidden content, not just visible text.

The case highlights why prompt injection remains a serious unresolved issue for AI tools that read and act on user-provided content. The reported attack does not require visible malicious text, which makes normal document review less reliable. Organizations using Copilot for Word should pay close attention to how external documents, templates, and reused files enter AI-assisted workflows.