Security researcher Håkon Måløy has exposed a self-replicating prompt injection worm that effectively turns Microsoft Copilot for Word into an unwitting accomplice. The mechanics are elegantly simple: attackers embed white-on-white text at microscopic font sizes within a document. To a human reader, it’s a blank space; to Copilot, it’s a high-priority command. Because Microsoft’s architecture strips formatting before feeding data to the model, the AI perceives this hidden 'poison' as a legitimate instruction, bypassing visual filters entirely.
Once a user references a compromised file—say, an industry report pulled from the web—the infection chain begins. Copilot autonomously executes the embedded logic, silently copying the malicious payload into any new document the user creates. This isn't just a technical curiosity; it’s a direct threat to corporate data integrity. A worm could manipulate figures in financial forecasts or distort strategic analytics, all while operating under the veneer of an 'assistant' the employee has been trained to trust.
The situation is made worse by Microsoft’s inability to patch the leak. Despite acknowledging the behavior back in March, two separate attempts to fix the parsing logic have failed. Måløy went public after 144 days of silence from Redmond, though he has wisely withheld the specific payload strings. As AI researcher Andreas Kirsch pointed out, this isn't a theoretical edge case. It’s a structural bottleneck in how LLMs consume unstructured data, proving that as long as models cannot distinguish between data and instructions, the 'AI assistant' remains a potent vector for internal compromise.