Document-borne AI worms can self-propagate through Copilot for Word
Points and comments are a snapshot, not live.
AI worm self-propagates through Microsoft Copilot for Word documents via hidden prompts.
A researcher demonstrates document-borne AI worms in Microsoft Copilot for Word. Hidden instructions in an attached document cause Copilot to manipulate output (e.g., halving financial figures) and copy the attack prompt into new documents via white text. This allows self-propagation across workflows without the original malicious document. Microsoft was notified 144 days prior but no robust mitigation exists. The attack exploits the fundamental inability of LLMs to distinguish instructions from data.
What commenters are saying
Commenters largely agree the vulnerability highlights an unsolved problem: LLMs cannot reliably separate instructions from data. Several note this is a known class of vulnerability comparable to SQL injection or in-band signaling. Some argue the issue is inherent to current LLM architectures, while others criticize building agentic systems on such foundations. A minority question whether the separation of code and data is even a natural or necessary design goal.