AI Worming through Word

A new prompt injection attack targets Microsoft Copilot for Word by embedding hidden instructions in documents, causing Copilot to manipulate the document and replicate the instructions into new carriers, enabling self-replication without the original attacker document. The vulnerability was responsibly disclosed to Microsoft, but no comprehensive fix has been released after 144 days.

An attacker places hidden instructions in a document that is later used as source material in Copilot for Word. Copilot may interpret those instructions as part of the user’s request, causing it to manipulate the document being drafted or edited. Copilot may then also copy the hidden instructions into the resulting document, turning that document into a new carrier. If the carrier is subsequently used in another Copilot-assisted workflow, the instructions can trigger again and propagate into further documents, even without the attacker’s original document being present. We've seen plenty of hidden white-on-white text before - the kids are using it in their job applications now https://x.com/ScienceYael/status/2082175224007848019 - but this is the first one I've seen that deliberately copies instructions to self-replicate itself. It was responsibly disclosed to Microsoft who then had 144 days to work on a fix, but so far unsurprisingly there's no mitigation that covers the full class of attack. Via Hacker News https://news.ycombinator.com/item?id=49096188 Tags: microsoft https://simonwillison.net/tags/microsoft , security https://simonwillison.net/tags/security , ai https://simonwillison.net/tags/ai , prompt-injection https://simonwillison.net/tags/prompt-injection , generative-ai https://simonwillison.net/tags/generative-ai , llms https://simonwillison.net/tags/llms