Copilot for Word AI Worm: Still Live After Two Patches

A self-propagating AI worm targeting Microsoft Copilot for Word was publicly disclosed today by Norwegian researcher Håkon Måløy, and every fix Microsoft shipped was bypassed within days. The attack hides malicious instructions as white text in Word documents, causing Copilot to execute the payload and copy the attack into new files. Microsoft has been aware since March 2026, and after 144 days of coordinated disclosure, no robust fix exists for the underlying vulnerability class.

A self-propagating AI worm targeting Microsoft Copilot for Word was publicly disclosed today by Norwegian researcher Håkon Måløy https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/ — and every fix Microsoft shipped was bypassed within days. The attack hides malicious instructions as white text inside Word documents. When those documents enter Copilot’s context window, Copilot executes the payload, silently alters the generated document’s content, and copies the attack into the new file. Microsoft has been aware since March 2026. After 144 days of coordinated disclosure, no robust fix exists for the underlying vulnerability class. How the Worm Spreads Through Normal Workflows The mechanics are straightforward, and that is what makes this alarming. An attacker embeds malicious instructions in a Word document as white text on a white background — invisible to humans but visible to Copilot after it strips document formatting. Victim A downloads what looks like a clean market analysis. They use it as Copilot context for a financial report. Copilot processes all document text equally, executes the hidden instructions, halves the Q1 and Q2 revenue figures in the output, and copies the payload into the new report disguised as “source metadata tracking.” Victim B then uses that infected report as Copilot context. The cycle repeats. Source attribution collapses entirely because the visible “author” of every manipulation is Copilot itself. No phishing link, no executable, no user error — just a normal document workflow and a file received from someone you trusted. The Register confirmed the attack chain https://www.theregister.com/security/2026/07/29/word-worm-crawls-into-copilot-spreads-chaos/5280588 with independent verification today. Microsoft Patched the Copilot AI Worm Twice. Both Fixes Failed. Måløy began coordinated disclosure with Microsoft in March 2026 — 144 days before going public today. Microsoft deployed two rounds of mitigations: an updated “Edit with Copilot” experience in April, and a model upgrade to GPT-5.5 in July. However, Måløy bypassed both with reworded payloads within days of each release. By July 15, two weeks ago, he confirmed the full attack chain works against GPT-5.6 — the current production model. Microsoft’s official position acknowledges “defense-in-depth” safeguards while also acknowledging “no robust mitigation for the broader vulnerability class is currently available.” That is a careful way of saying: we cannot actually fix this. The 144-day disclosure timeline is worth sitting with. That is nearly five months during which this attack was operational in production Microsoft 365 environments, against a vulnerability Microsoft had been informed of, with a bypass arriving the same week as the latest patch. Related: Claude Breaks Post-Quantum HAWK Cipher in Just 60 Hours This Is Not a Bug. It Is a Prompt Injection Architecture Problem. Prompt injection works because LLMs have no way to distinguish trusted instructions from untrusted document content. Both arrive as the same stream of tokens. Filters help at the margin but do not solve the root issue — as Måløy puts it, asking a model to analyze untrusted data to determine if it is safe is “like asking an interpreter to execute an untrusted program to determine whether that program is safe to execute.” You cannot delegate the trust decision to the thing you do not trust. OWASP noted in June https://www.helpnetsecurity.com/2026/06/11/owasp-prompt-injection-ai-security-failures/ that prompt injection attacks surged 340% in 2026 and called the flaw structural rather than patchable. Moreover, this is not unique to Copilot. ClawWorm, published in March 2026 https://arxiv.org/abs/2603.15727 , achieved a 64.5% success rate propagating through AI agent frameworks. GuardFall, released last week, found shell injection vulnerabilities in 10 of 11 AI coding agents. Måløy’s worm is the first to hit mainstream commercial productivity software at scale, but it belongs to a rapidly growing attack class that the entire industry has not solved. If you are deploying any AI assistant that processes external documents — Copilot, Gemini Docs, Claude with files — the same structural vulnerability applies to your stack. What to Do Right Now Microsoft’s next mitigation will come. It will likely be bypassed again, because the underlying architecture has not changed. While waiting, the most effective defensive steps available today are: - Convert external documents to plain text before using them as Copilot context — this strips hidden formatting and exposes embedded payloads before they reach the model - Treat every external document as untrusted, the same way you would treat a macro-enabled .docm file — verify the source before using it as AI context - Manually review any Copilot-generated financial, legal, or procurement content before distribution - Audit Copilot activity logs for unusual document modification patterns in high-stakes workflows Måløy noted that some of these steps essentially negate the efficiency gains that made Copilot appealing in the first place. That is the uncomfortable trade-off right now: you can use Copilot with external documents, or you can have confidence in the output — not easily both. Key Takeaways - A self-propagating AI worm exploiting Copilot for Word was publicly disclosed today July 29, 2026 ; confirmed working against the current production model GPT-5.6 - Microsoft issued two mitigations over 144 days of coordinated disclosure; both were bypassed with modified payloads within days - The root cause is architectural — LLMs cannot distinguish trusted instructions from untrusted document content at the token level, and no patch fully addresses this - Copilot is the first mainstream productivity tool hit by this attack class; ClawWorm and GuardFall show it is an industry-wide problem - Practical mitigation today: convert external docs to plain text before Copilot context; manually audit AI-generated outputs in financial, legal, and procurement workflows