A security researcher has shown that an ordinary Microsoft Word document can carry hidden instructions that hijack Copilot, quietly alter the file it produces, and copy themselves into that new file, so the attack spreads from colleague to colleague without anyone noticing.
Håkon Måløy disclosed the technique, which he calls AI Worming through Word, on 28 July 2026 in the third part of his Context Collapse series. Analysts at NSFOCUS, who reviewed the work, describe it as the first known document-based AI worm to achieve self-replication inside a mainstream commercial office suite.
How the attack works
The technique rests on a gap between what you see and what the model sees. Before Copilot for Word hands a document to the underlying large language model, it strips out formatting, including font color and size. Text set in white on a white background at a tiny point size is therefore invisible on screen but perfectly legible to the model. Måløy hides a block of instructions, written as JSON, at the end of an otherwise unremarkable document.
Two things have to happen for it to fire: the poisoned file has to reach the target, and it has to end up in Copilot's context window, the working set of text the model reads before it answers. Neither is difficult. The attacker does not need to break into the victim's Microsoft 365 tenant, only to share a document through SharePoint, Teams, Outlook, or any other normal channel. The user can attach it themselves, or the "Edit with Copilot" feature can pull it out of OneDrive on its own if its contents look relevant to whatever the user is working on.
Once that text is in context, the model treats the hidden instructions as part of the user's request. In Måløy's proof of concept, the payload told Copilot to halve every number in a financial report, and to append the full malicious prompt to the end of the document it generated, hidden again in small white type. Copilot showed the user no prompt, no warning, and no mention of either action.
Why it spreads
That second instruction is what turns a one-off prompt injection into a worm. The document that comes out carries the payload, and it now has the credibility of a legitimate internal file. When a colleague feeds it to their own Copilot drafting task, the cycle repeats: the figures are tampered with again, and the payload is copied forward again. NSFOCUS notes the loop can run indefinitely inside an organization, and can cross into other organizations when a contaminated file is sent to a partner or dropped on a shared SharePoint site.
The damage here is to integrity rather than confidentiality. Nothing is stolen and nothing is encrypted, but the figures people are making decisions from are wrong, with no visible sign of it. Researchers have repeatedly turned Copilot's own document access against it, from the EchoLeak zero-click injection in Microsoft 365 Copilot to more recent work weaponizing Copilot and AI agents to steal data. Those attacks exfiltrate. This one propagates, which places it closer to Morris II, the first self-replicating AI worm, demonstrated against generative AI assistants in a lab.
What you should do
There is no patch to apply. Microsoft spent a 144-day coordinated disclosure window on mitigations, including a new "Edit with Copilot" experience and upgrades of the underlying model to GPT-5.5 and then 5.6, and Måløy was still able to reproduce the complete worm chain. NSFOCUS assesses the weakness as architectural, common to current mainstream LLM systems, and not something a single patch closes.
The root problem is that a model has to read untrusted content before it can judge whether that content is hostile, by which point the hostile text has already shaped the judgment. Until that changes, the useful controls are organizational rather than technical: limit what Copilot is allowed to retrieve automatically from shared storage, treat documents that arrive from outside as untrusted input to any AI workflow rather than as reference material, and check AI-generated figures against their original source before acting on them.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.