Copilot's Self-Copying Prompt Is a Macro Virus, Not a Worm

Security researcher Håkon Måløy published a working demonstration of a self-replicating prompt injection that spreads document-to-document through Microsoft 365 Copilot inside Word, using hidden text to propagate payloads via the assistant's drafting flow. Microsoft shipped fixes after a 144-day coordinated disclosure but conceded the underlying class of vulnerability remains open. Måløy calls it a worm, though the mechanism requires human action for each propagation hop, unlike classic self-propagating worms.

Security https://sourcefeed.dev/c/security Article Copilot's Self-Copying Prompt Is a Macro Virus, Not a Worm A hidden-text injection in Word replicates through Copilot's drafting flow — and the 1990s already told us how to contain it. Ji-ho Choi https://sourcefeed.dev/u/jiho choi Security researcher Håkon Måløy has published a working demonstration of something the field has been bracing for since early 2024: a self-replicating prompt injection that spreads document-to-document through Microsoft 365 Copilot https://www.microsoft.com/en-us/microsoft-365/copilot inside Word. Hide instructions in one file as white-on-white text, let Copilot read it, and the assistant both does what the attacker says and copies the payload — hidden the same way — into whatever it writes next. The next document is now infected. Måløy calls it a worm, and after a 144-day coordinated disclosure, Microsoft shipped fixes while conceding the underlying class stays open. He's right that this matters. He's also stretching the word "worm," and the gap between those two things is exactly where developers need to think clearly. What actually happens The mechanism is almost boring, which is the scary part. A document contains attacker text formatted to be invisible to a human — white on a white background, or any of the dozen other tricks off-canvas positioning, one-point font, image alt text . Word strips formatting before handing content to the model, so what's invisible to you is plain, high-priority text to Copilot. The instructions tell it to do two things: perform some malicious edit — Måløy's proof of concept quietly halves every financial figure in the draft — and append the full instruction block, again as hidden text, to the output. The propagation vector is a feature, not a bug. "Edit with Copilot" and the drafting flows pull in related material from OneDrive automatically as grounding context. So an infected file sitting in a shared folder doesn't just wait to be opened — it gets retrieved as source material the next time anyone asks Copilot to draft something adjacent. Each generation reseeds the payload. No macro, no executable, no security prompt. The carrier is a normal .docx that passes every content filter because the malicious part is, definitionally, the content the filter has to read. This is the OWASP LLM01 indirect prompt injection https://genai.owasp.org/llm-top-10/ failure mode taken to its logical end. As Måløy puts it, "the tokens being inspected participate in the act of inspection" — there's no architectural line between instructions and data inside a transformer, so any content the model must process to evaluate can also steer it. You can't grep your way out of that. The prior art it builds on None of the primitives here are new, and saying so isn't a knock — it's the reason to take it seriously. In March 2024, Ben Nassi, Stav Cohen, and Ron Bitton demonstrated Morris II https://arxiv.org/abs/2403.02817 , an adversarial self-replicating prompt that poisoned the RAG store of an email assistant and forwarded itself to new victims. That was a lab against a toy pipeline. In 2025, Aim Labs' EchoLeak CVE-2025-32711 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711 turned a single crafted email into zero-click data exfiltration from M365 Copilot, and a separate wormable prompt-injection RCE landed in GitHub Copilot's agent mode CVE-2025-53773 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53773 . Måløy's contribution is to show the self-replication half running inside a mainstream, shipping productivity suite through ordinary human workflows — not a research harness. That's the line being crossed. Where the "worm" framing breaks Here's my disagreement, and it's the practical one. A classic worm self-propagates without human action — that's what made the 1988 Morris worm and Code Red terrifying. This is not that. Every hop requires a person to open an infected document and invoke Copilot on it, or to draft something that happens to retrieve the infected file as context. It spreads at the speed of people using Copilot, and it dies wherever nobody does. That's closer to a macro virus than a worm — and the macro-virus comparison, raised in the Hacker News thread https://news.ycombinator.com/item?id=49096188 , is the more useful mental model. We spent the late '90s learning that "documents can carry executable intent" is a category, not a bug, and we eventually contained it with signing, sandboxing, and disabling-by-default. We're at the 1997 stage of the LLM version. The distinction isn't pedantry. If you model this as a worm, you look for a patch. If you model it as macro-borne malware, you build for containment: provenance, blast radius, and human review at trust boundaries — because there is no patch coming for "the model reads the document." What developers actually do about it If you ship anything on top of M365 Copilot, Copilot Studio agents, or your own RAG-over-documents system, treat this as a design requirement today: Provenance is now security-critical. Tag retrieved context by trust level and don't let untrusted-origin documents issue high-privilege instructions to the model. Grounding content and user commands need different lanes, even though the transformer won't enforce it for you. Detect on the invisible layer. Rendered-text scanning misses white-on-white by definition. Check for hidden runs, zero-opacity, off-page content, and suspicious formatting deltas before content reaches the model — this is a document-hygiene pipeline, not a model prompt. Never auto-redistribute model output. The replication step only closes the loop if generated documents flow onward unreviewed. A human check before a Copilot-drafted file leaves the team breaks the chain — which is also why this stays a virus, not a worm. Constrain the action surface. Morris II's authors proposed a guardrail "Virtual Donkey" that flagged propagation with a 0.015 false-positive rate. The general principle holds: the fewer autonomous, unreviewed writes your agent can make, the smaller the worm surface. Microsoft's fixes are real and worth taking, but Måløy is correct that they're patches on a structural hole. The honest read is this: indirect prompt injection is the SQL injection of the agent era, and self-replication is what it looks like when you point it at a system whose inputs and outputs are the same corpus. The winners over the next two years won't be whoever bolts the best filter onto the model — they'll be whoever designs their document pipelines assuming the model will get hijacked, and limits what it can do when it does. Sources & further reading - Context Collapse, Part 3 - AI Worming through Word https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/ — enklypesalt.com - Document-borne AI worms can self-propagate through Copilot for Word https://news.ycombinator.com/item?id=49096188 — news.ycombinator.com - Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications https://arxiv.org/abs/2403.02817 — arxiv.org - Inside CVE-2025-32711 EchoLeak : Prompt injection meets AI exfiltration https://www.hackthebox.com/blog/cve-2025-32711-echoleak-copilot-vulnerability — hackthebox.com - OWASP Top 10 for LLM Applications https://genai.owasp.org/llm-top-10/ — genai.owasp.org Ji-ho Choi https://sourcefeed.dev/u/jiho choi · Security & Cloud Editor Ji-ho covers the increasingly tangled overlap between cloud architecture and security, drawing on a background as a penetration tester to keep his reporting grounded in real-world attack paths. He never lets a vendor claim go unquestioned and insists that every buzzword come with a proof of concept. Discussion 0 No comments yet Be the first to weigh in.