The AI Worm Escaped the Lab — and Landed in Word

A proof-of-concept attack from the En Klype Salt team shows prompt-injection payloads self-replicating through Microsoft 365 Copilot in Word, propagating from one business document to another via ordinary drafting workflows. The researchers reported the vulnerability to Microsoft on March 6, 2026, but Microsoft has assessed the issue as out of scope, stating it is an inherent limitation of LLMs rather than a security vulnerability. The attack exploits cross-domain prompt injection, hiding malicious instructions in documents that Copilot then re-embeds into generated files, allowing the worm to spread through OneDrive without user interaction.

Security https://sourcefeed.dev/c/security Article The AI Worm Escaped the Lab — and Landed in Word A proof-of-concept shows prompt-injection payloads replicating through Copilot-edited documents, and Microsoft won't call it a vulnerability. Ji-ho Choi https://sourcefeed.dev/u/jiho choi Two years ago, a self-replicating AI worm was a lab curiosity. Cornell Tech and the Technion built Morris II https://arxiv.org/abs/2403.02817 , a poisoned email that rode RAG pipelines to make GenAI assistants leak and re-send data with zero clicks — but it lived in a research harness the authors controlled end to end. The interesting thing about the latest write-up from the En Klype Salt team isn't the technique. It's the venue. They ran the same class of attack against Microsoft 365 Copilot https://www.microsoft.com/en-us/microsoft-365/copilot inside Word, on a shipping enterprise product, and watched the payload copy itself from one business document into the next through ordinary drafting workflows. That's the line worth marking. The AI worm left the lab. How the propagation actually works The primitive is boring and that's the point: cross-domain prompt injection. You hide instructions in a document — white text on a white background, tiny font, the kind of thing Copilot strips of formatting before it hands text to the model. Invisible to the human, fully legible to the LLM. This is old news; Embrace The Red https://embracethered.com/blog/posts/2024/m365-copilot-prompt-injection-tool-invocation-and-data-exfil-using-ascii-smuggling/ and others have been pulling data out of Copilot this way since 2024. The new part is stage two. The researchers' payload does two jobs at once. First, the malicious task — in their proof of concept, quietly halving the numbers in a financial report. Second, a self-replication directive dressed up as a benign "source-tracking" feature that instructs Copilot to re-embed the entire hidden prompt into the document it generates, again using concealed formatting. The output document is now a carrier. Nobody attached the original malicious file to the second session; the freshly infected internal report is the malicious file, and it's sitting in OneDrive looking trustworthy. Two things make this bite in a real tenant. Copilot's Work IQ mode searches a victim's OneDrive for relevant material and pulls it into context without an explicit attachment — so a compromised Q1 report gets auto-included when someone drafts Q2. And the infected document carries the full provenance of a legitimate internal file: no external sender, no attachment prompt, no obvious tell. The worm rides the exact reuse patterns that make Copilot useful. The part that should worry you: Microsoft isn't going to fix this The disclosure timeline is the real story. The researchers reported to MSRC on March 6, 2026. Microsoft confirmed the behavior, shipped a mitigation on April 3, and within a week the team had reproduced a new variant. Over the following months Microsoft tried again — including swapping the underlying model — and by the July 28 public disclosure the exploit still fired. Each fix killed a specific payload string. None closed the class. This tracks with Microsoft's stated posture. As BleepingComputer reported https://www.bleepingcomputer.com/news/security/are-copilot-prompt-injection-flaws-vulnerabilities-or-ai-limits/ , the company has been assessing a string of Copilot prompt-injection reports as "out of scope" because, in their framing, no security boundary is crossed and impact stays within the requesting user's execution environment. Translation: they consider this an inherent limitation of LLMs, not a vulnerability that earns a CVE and a patch. There's a real argument on both sides. Models genuinely struggle to separate instructions from data when both arrive as tokens in the same context — that's not a Microsoft bug, it's the architecture. But the counter, made by researchers in that same report, lands harder: competing assistants refuse many of these same attacks. If Claude or another system declines the injection and Copilot obeys it, "the model can't tell instructions from data" starts to sound like a design choice about input validation rather than a law of physics. For anyone building on this platform, the classification matters more than the semantics. If Microsoft won't treat prompt injection as a fixable vulnerability, you cannot wait for a patch. The trust boundary is yours to enforce. What this means if you're wiring AI into your own tooling The uncomfortable generalization: any system where model output can re-enter a trusted context is a candidate for this. Copilot for Word is just the most consequential example because half the corporate world drafts documents in it. But the pattern — agent reads untrusted content, agent produces content, that content becomes another agent's input — describes most agentic pipelines being built right now. OWASP ranks indirect prompt injection 1 https://genai.owasp.org/llm-top-10/ in its LLM Top 10 for exactly this reason. Concrete defenses, in rough order of leverage: Treat model output as tainted. If Copilot-generated text can be re-ingested by another AI step, it carries the same trust level as the untrusted input that produced it. Provenance tracking and content sanitization on the output side, not just the input, is the thing most teams skip. Break the re-ingestion loop. The worm needs generated content to flow back into a privileged context. Dual-LLM or quarantine patterns — where a privileged planner never sees raw untrusted text, only structured, validated summaries from an unprivileged model — cut the propagation path even when injection succeeds. Kill invisible payloads at ingest. Strip zero-alpha text, normalize whitespace and Unicode, flatten formatting to visible content before the model ever sees the document. This won't stop plaintext injection, but it removes the concealment that makes self-replication survivable across document generations. Scope your retrieval. Auto-discovery over an entire OneDrive is a propagation accelerant. Constrain what an agent can pull into context, log what it pulled, and treat "the agent found a relevant internal doc on its own" as an attack surface, not a feature. None of this is a clean fix, because there isn't one — that's the honest read. Prompt injection is the buffer overflow of the LLM era: a foundational, hard-to-eliminate flaw that we'll spend the next decade building mitigations and conventions around rather than solving outright. The difference is that this time the vendor of the most widely deployed product has told you, more or less openly, that the defense is your job. Build accordingly. Sources & further reading - Context Collapse, Part 3 - AI Worming through Word https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/ — enklypesalt.com - Are Copilot prompt injection flaws vulnerabilities or AI limits? https://www.bleepingcomputer.com/news/security/are-copilot-prompt-injection-flaws-vulnerabilities-or-ai-limits/ — bleepingcomputer.com - Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications https://arxiv.org/abs/2403.02817 — arxiv.org - Microsoft Copilot: From Prompt Injection to Exfiltration of Personal Information https://embracethered.com/blog/posts/2024/m365-copilot-prompt-injection-tool-invocation-and-data-exfil-using-ascii-smuggling/ — embracethered.com - OWASP Top 10 for LLM Applications https://genai.owasp.org/llm-top-10/ — genai.owasp.org Ji-ho Choi https://sourcefeed.dev/u/jiho choi · Security & Cloud Editor Ji-ho covers the increasingly tangled overlap between cloud architecture and security, drawing on a background as a penetration tester to keep his reporting grounded in real-world attack paths. He never lets a vendor claim go unquestioned and insists that every buzzword come with a proof of concept. Discussion 0 No comments yet Be the first to weigh in.