Picture an innocent-looking Word document, downloaded from a trusted site. You use it as a source in Copilot to draft a financial report. A few minutes later, your numbers have been silently altered, and the document you just produced has become the new vector for an attack that will spread to your colleagues. This chain of document infection is no longer a theoretical hypothesis: it has just been publicly demonstrated for the first time in a mainstream office productivity environment.
On July 28, 2026, the security researcher known under the pseudonym Måløy published the third installment of his “Context Collapse” series, in which he documents a worm-like self-propagation capability exploiting Copilot for Word. The demonstration of this AI worm in Copilot for Word is a serious wake-up call for every organization that has integrated Microsoft’s assistant into its document workflows.
A first public demonstration of document self-propagation
The researcher describes an attack that requires no access to the victim’s Microsoft 365 tenant. The attacker only needs to deliver a booby-trapped document to the target, whether through SharePoint, Teams, Outlook, or any other sharing channel.
Once this document is used as a source in Copilot for Word, the attack triggers. It modifies the content of the document being drafted, then copies its own malicious instructions into it. The freshly generated document becomes a new healthy carrier, capable of contaminating other files in turn.
Måløy notes that this is, to his knowledge, one of the very first public demonstrations of a self-propagating AI worm spreading through documents in a mainstream commercial office suite. Before this, efforts like Morris II had demonstrated the principle in email assistant ecosystems, but never in a word processor integrated into daily workflows.
How the attack unfolds in two stages
The exploit proceeds in two distinct steps: the initial foothold, then propagation.
Step 1: establishing the beachhead
The attacker crafts a document containing hidden instructions. In the proof of concept, Måløy used white text on a white background at a small font size, making it invisible to the human eye. However, Copilot for Word strips all formatting (color, size) before passing the text to the underlying language model. The result: the text remains perfectly readable by the AI, yet completely invisible to the victim.
The malicious prompt is structured in two parts:
- A part that dictates the action to perform, such as halving all figures in a financial report;
- A part that orders Copilot to copy the entire prompt into the generated document, again in white text at a small size, under the guise of a harmless readability improvement instruction.
Step 2: automatic propagation
The document produced by Copilot now contains the hidden malicious instructions in its turn. If this document is used as a source in a new drafting session with Copilot, the attack triggers again. It alters the figures in the new report and copies itself once more.
The critical point is that the original document is no longer needed. An internal document, created by a legitimate colleague, becomes the vector. And since it inspires trust, subsequent victims have no reason to be suspicious.
In his tests, Måløy reproduced the full chain on GPT-5.6, the latest available model from OpenAI at the time of publication.
An architectural problem, not a simple bug
What makes this vulnerability particularly concerning is that it is not tied to an implementation error that a patch could quickly fix. It stems from a structural problem common to all LLM-based systems: the confusion between instructions and data.
To be useful, an AI assistant must process emails, documents, web pages, and other content potentially controlled by an attacker. All of this content lands in the same context window as the system instructions and the user’s queries. The model makes no distinction between what constitutes a legitimate directive and what is potentially hostile external data.
As Måløy writes in his closing reflections: the weakness is architectural. To date, no comparable product has comprehensive protection against this class of vulnerability. Resolution will require fundamental research, not just a patch.
Microsoft’s response: targeted fixes, a still-open class
The disclosure was coordinated with the Microsoft Security Response Center (MSRC) and the relevant product teams. The coordination period lasted 144 days (90 days initially, extended twice). Here is the timeline of events:
- March 6, 2026: initial submission to MSRC with reproduction steps, videos, and the prompts used.
- March 31, 2026: Microsoft confirms the reported behavior and begins mitigation work.
- April 3, 2026: first mitigation deployed with the new “Edit with Copilot” experience.
- April 9, 2026: the attack is reproduced with a modified prompt; new report filed with MSRC.
- July 14, 2026: second mitigation, consisting of switching to the GPT-5.5 model.
- July 15, 2026: the full attack chain is reproduced on GPT-5.6.
- July 28, 2026: public disclosure, with the attack remaining exploitable.
Microsoft succeeded in blocking the specific payloads submitted by the researcher. But each time the prompt is rephrased, the attack works again. The underlying vulnerability class remains open.
The researcher made the decision to publish despite the absence of a complete fix, arguing that defenders cannot reduce their exposure to a risk they are unaware of.
What this means in practice for organizations
No client-side measure fully neutralizes the risk at this stage. Microsoft nevertheless recommends a few precautions:
- Treat any externally sourced document as potentially untrusted when used with Copilot;
- Inspect attached documents before launching a generation or edit with Copilot;
- Carefully review documents generated or modified by Copilot before reusing, sharing, or distributing them.
Beyond these measures, the business impact can be profound. If the attack spreads silently within an organization through normal document workflows, it can erode the informational foundation on which strategic decisions are based. Falsified financial reports, altered summaries, manipulated figures: all generated by legitimate employees, using legitimate tools.
Traceability becomes extremely difficult. Once the attack has jumped from document to document, identifying its initial entry point becomes a heavy digital forensics undertaking, especially in environments where Copilot is coupled with systems like Microsoft Cowork or Microsoft Scout, which automate document handling at scale.
Key takeaways
- A researcher has publicly demonstrated the first self-propagation capability of an AI worm through Word documents using Copilot.
- The attack requires no access to the victim’s tenant, only the sharing of a booby-trapped document.
- The vulnerability exploits the fundamental confusion between instructions and data in LLM-based systems.
- Microsoft has deployed several targeted fixes, but the underlying vulnerability class remains exploitable.
- Organizations must strengthen vigilance around external documents used with Copilot and review the assistant’s output before distribution.
This demonstration reminds us of a truth sometimes forgotten amid the enthusiasm for AI integrated into everyday tools: every new touchpoint between a language model and uncontrolled content expands the attack surface. The question is no longer whether AI assistants can be compromised, but how organizations will adapt their processes to live with this structural risk.
If these security challenges around LLMs and Microsoft 365 environments resonate with you, I continue to explore these topics on this blog. Feel free to react or share this article: the more of us who understand these mechanisms, the better we can defend our work environments.
Sources
- Context Collapse, Part 3 – AI Worming through Word, Original research article by Måløy (En Klype Salt), July 2026. Primary source detailing the exploit, the coordinated disclosure timeline with MSRC, and the architectural implications.
- The Register, Word worm crawls into Copilot, spreads chaos, News coverage by a recognized tech outlet, with researcher quotes and context.