Document-Borne AI Worms Self-Propagate Through Copilot for Word: What HN Thinks

Last updated: July 29, 2026

Security researcher Hakon Maloy published a coordinated disclosure today showing that attacker-controlled instructions hidden inside a Word document can hijack Microsoft Copilot for Word, silently alter financial data in generated reports, and self-propagate the attack to downstream documents. The post hit the Hacker News front page with 312 points and 234 comments. Here is what the disclosure reveals, what the HN community is saying, and why this vulnerability class may not have a clean fix.

What the Disclosure Found#

Maloy reported the issue to the Microsoft Security Response Center (MSRC) on 2026-03-06. Over a 144-day coordination period, Microsoft deployed two mitigations -- including a model upgrade to GPT-5.5 -- but neither closed the broader vulnerability class. At publication, the complete attack chain still reproduces on GPT-5.6.

The attack works in two stages:

Stage 1 - Foothold. An attacker embeds a malicious prompt in a Word document, concealed as white text on a white background in a small font size. Copilot for Word strips text formatting before passing content to the underlying LLM, so the hidden text remains fully readable to the model while invisible to the user. When a victim attaches the malicious document as source material for a Copilot drafting session, the hidden instructions cause Copilot to alter document content -- for example, halving all financial figures in a Q1 report -- and copy the full malicious prompt into the new document using the same white-on-white concealment.

Stage 2 - Self-propagation. The compromised document now carries the attack payload. When a colleague later uses it as source material for their own Copilot drafting session, the attack triggers again. It alters the new document and copies itself forward. The original attacker document is no longer required. The worm spreads through ordinary document workflows -- SharePoint, Teams, Outlook -- carried by legitimate internally-created files.

Maloy demonstrated that in "Edit with Copilot" (Work IQ) mode, Copilot will autonomously find the malicious document in the victim's OneDrive during a search for relevant source material, without the victim needing to explicitly attach it.

What HN Is Saying#

The HN discussion drew immediate parallels to an earlier era of document-borne malware.

Several commenters noted the structural similarity to macro viruses. As one put it: "History does not repeat but it rhymes. Strong Macro Virus vibes incoming." Another added: "the real upgrade from macro viruses is that the worm can now improvise. Last time it needed a script, now it just needs a persuasive paragraph."

A recurring theme was the architectural nature of the vulnerability. Maloy himself appeared in the thread to answer questions. His post argues that the weakness is inherent to how LLMs process external content: the model must read untrusted content to determine whether it is safe, but by the time it makes that determination, the attacker's tokens are already influencing the computation. He compares it to "asking an interpreter to execute an untrusted program to determine whether that program is safe to execute."

The disclosure states: "Any system that integrates an LLM into a trusted workflow today must assume that attacker-controlled content entering the model's context will result in compromise at some rate." Commenters largely agreed with this framing. One wrote: "It's increasingly clear that AI needs to be heavily regulated to be safe for public use."

A practical question emerged repeatedly: why does Copilot have access to text that the human user cannot see? If white-on-white text is invisible to a reader, why should the model read it at all? The answer is that Copilot strips formatting before passing text to the LLM, which is normally a useful normalization step, but here it defeats the only concealment mechanism a user might rely on.

The most-upvoted sentiment was resignation about the difficulty of the root cause. As one comment summarized: "Isn't it obvious by now that it's never going to be possible to fix this? The model doesn't know the difference between data and instructions."

Why It Matters for Developers#

This disclosure is part 3 of Maloy's "Context Collapse" series. Part 1 demonstrated poisoning Copilot's persistent memory through external inputs, and part 2 showed how email bodies could instruct Copilot to take actions. Taken together, the series forms a coherent picture: the security boundary between "content" and "instruction" does not meaningfully exist for current LLM architectures.

The earlier Morris II paper showed self-replicating prompt propagation in GenAI email assistants, but this is the first public demonstration of document-borne worming through a mainstream commercial productivity suite. The difference in scale is significant: Microsoft 365 serves hundreds of millions of enterprise users, and Copilot is deeply integrated into Word, Excel, PowerPoint, Teams, and Outlook.

Two implications stand out:

Loss of traceability. Once a worm has propagated through internal documents, tracing the origin becomes extremely difficult. Each affected document was created by a legitimate internal resource. Maloy notes that Copilot does not visibly mark which changes it has applied after a user approves a generation, so there is no audit trail for what was altered.

Cross-organizational spread. Organizations that share SharePoint sites or Teams channels with partners may unknowingly transmit contaminated documents to other companies. A worm's initial entry point for a given organization could be an already-affected trusted partner.

What Can Teams Do Today#

Microsoft has not released a fix that closes the vulnerability class. The disclosure includes three customer-side mitigations:

1. Treat externally sourced documents as untrusted when used with Copilot.
2. Review attached documents before starting a Copilot generation or edit.
3. Carefully review Copilot-generated or Copilot-edited documents before reusing or sharing them.

None of these are automated, and none address the self-propagation mechanism once a document is already compromised. The practical takeaway is that document workflows involving Copilot for Word currently lack a security boundary between "information to use" and "instructions to follow."

FAQ#

How does the Copilot for Word AI worm work?#

An attacker hides a malicious prompt in a Word document as small white text on a white background. Copilot strips formatting before passing content to the model, so the model reads the hidden text. When a victim uses the document as source material, Copilot alters the new document, for example halving financial figures, and copies the hidden prompt into it, so the next person who uses that document triggers the attack again.

Has Microsoft fixed the Copilot for Word worm vulnerability?#

No. Over a 144-day coordination period Microsoft deployed two mitigations, including a model upgrade to GPT-5.5, but neither closed the broader vulnerability class. At publication the full attack chain still reproduced on GPT-5.6.

How can teams protect themselves from document-borne prompt injection in Copilot?#

The disclosure lists three customer-side mitigations: treat externally sourced documents as untrusted when used with Copilot, review attached documents before starting a Copilot generation or edit, and carefully review Copilot-generated or Copilot-edited documents before reusing or sharing them. None of them are automated.

Why is this vulnerability class so hard to fix?#

The researcher argues the model has to read untrusted content to decide whether it is safe, and by then the attacker's tokens are already influencing the computation. He compares it to asking an interpreter to execute an untrusted program to determine whether that program is safe to execute.

Sources#

• Disclosure post: Context Collapse, Part 3 - AI Worming through Word
• HN discussion: Document-borne AI worms can self-propagate through Copilot for Word
• Context Collapse Part 1: Poisoning Copilot Memory
• Context Collapse Part 2: When Emails Instruct
• Morris II paper: Self-Replicating Prompt Propagation

Continue Reading#

• The Miasma Worm Is Targeting AI Developers: What You Need to Audit Now - A different self-propagating worm targeting AI coding tools through open-source repos
• Prompt Injection Is Really Role Confusion - Why models fail to distinguish instruction from tool output or user content
• AI Agent Containment Needs a Capability Ledger - What stops a worm from executing privileged actions once injected
• Agent Config Files Are Executable Supply Chain - How seemingly benign configuration files become attack vectors for AI agents
• AI Coding Agent Security Models Compared 2026 - How Copilot's permission model compares to other tools on security boundaries
• Cursor Hit $50B -- Here's What the AI IDE Landscape Actually Looks Like Now
• Anthropic Self-Replicating AI Research: What Small Models Can Actually Do - Anthropic's lab test of small-model replication across IoT devices