AI Worm in Copilot: a new cyber threat
At the end of July 2026, security researcher Håkon Måløy published the results of research demonstrating the existence of an AI Worm capable of propagating through Microsoft Word documents used with Copilot. The discovery quickly caught the attention of the cybersecurity community because it does not exploit a macro, an executable, or a classic vulnerability, but rather the way AI models process the received context.
What is an AI Worm?
An AI Worm is a malicious instruction hidden within a document, formulated to be interpreted by an AI assistant as a legitimate command.
Unlike traditional computer worms, this type of attack:
- does not execute code on the computer;
- does not require macros;
- does not install malware;
- exclusively leverages how an AI model (LLM) interprets the context of a document.
In other words, the “infection” does not occur at the operating system level, but at the level of information processed by the AI.
How does the attack on Microsoft Copilot work?
According to the demonstration published by Håkon Måløy, the attacker introduces hidden instructions into a Word document. These instructions can be masked using very small text, a color identical to the background, or other methods that make them invisible to the user.
When the document is used as a source for Microsoft Copilot:
- Copilot reads the entire content of the document.
- The hidden instructions are interpreted as part of the context.
- The AI model can modify the generated output according to the attacker’s commands.
- More severely, it can copy the same instructions into the newly created document.
- The new document in turn becomes a carrier of the attack and can infect other Copilot-based workflows.
Practically, a mechanism of self-propagation emerges, similar to the concept of a classic worm, but without code execution.
Why is this vulnerability different?
Most cyberattacks aim to compromise a computer system.In this case, the target is the AI’s decision-making process.
The attack leverages a phenomenon known in AI security as Prompt Injection. In this scenario the attacker-controlled instructions are mistaken for legitimate user commands.
Instead of compromising the computer, the attacker compromises the responses generated by the AI. This difference is essential because classic antivirus solutions are not designed to detect such threats.
What does “Context Collapse” mean?
In his series of articles “Context Collapse,” Håkon Måløy explains that LLM models do not fundamentally distinguish between:
- user instructions;
- document content;
- text entered by an attacker.
All of these arrive in the same context window and are processed together. This architectural limitation means that an apparently benign document can influence AI behavior without the user noticing anything unusual.
What risks does the new AI Worm pose for organizations?
In the enterprise environment, Copilot is frequently used for:
- financial reports;
- technical documentation;
- contracts;
- internal policies;
- business analyses;
- summarizing external documents.
If one of the documents used as a source contains hidden instructions, these can influence all subsequently generated documents.
Among the identified risks are:
- discreet modification of information;
- alteration of financial reports;
- insertion of false content;
- automatic propagation of instructions to other documents;
- compromise of the trust chain between users and AI systems.
What mitigation measures has Microsoft adopted?
The researcher responsibly disclosed the vulnerability to Microsoft several months before publishing the findings.
Microsoft responded by implementing two rounds of mitigation measures. However, the published proof of concept showed that an attacker could bypass those mitigations by rephrasing the malicious instructions.
According to the researcher, the issue stems from the underlying architecture of large language models. Because LLMs process all available context without reliably separating trusted instructions from untrusted content, simple application-level filters cannot fully eliminate this class of attack.
How can companies protect themselves?
Although a perfect solution does not yet exist, specialists recommend several preventive measures:
- treating external documents as potentially untrustworthy sources;
- limiting the use of unknown documents as input for Copilot;
- verifying AI-generated results before distribution;
- implementing AI Security and AI Governance policies;
- training employees on the risks of Prompt Injection;
- monitoring documents circulating between teams and AI systems.
Security teams should consider every document supplied to an AI assistant as a potential attack surface, just as they treat email attachments and externally downloaded files.
Why is this case important for the future of AI security?
This discovery goes beyond exposing a specific vulnerability in Microsoft Copilot for Word. It reveals a broader challenge that affects many generative AI systems: large language models cannot reliably distinguish between legitimate information and malicious instructions when both appear in the same context.
As organizations increasingly rely on AI agents for drafting, analysis, and automation, attackers may use similar techniques more frequently. Security teams must therefore treat AI security as a discipline in its own right rather than an extension of traditional IT security. Organizations should implement dedicated governance policies, validate the sources they feed into AI systems, and establish controls for managing the context that generative models process.
Frequently Asked Questions (FAQ)
What is an AI Worm?
An AI Worm is an attack based on hidden instructions within a document, which causes an AI model to execute certain actions and copy the same instructions into subsequently generated documents.
Is Microsoft Copilot vulnerable to the new AI worm?
Håkon Måløy’s proof-of-concept research shows that hidden prompt injection instructions inside documents can influence Microsoft Copilot for Word and may allow the attack mechanism to propagate across certain workflows.
Is this malware?
No. The attack does not execute code and does not install malicious software. It exploits how an AI model interprets document content.
How can organizations reduce the risk posed by the new AI Worm?
By validating external documents, limiting the sources used by AI, verifying generated results, and implementing governance and security policies dedicated to the use of artificial intelligence.
Information sources: enklypesalt.com, theregister.com
