Microsoft Copilot Vulnerable: A Worm Spreads Through Word

Microsoft Copilot Vulnerable: A Worm Spreads via Word

A security researcher has demonstrated how a prompt injection attack in Microsoft Copilot for Word can propagate autonomously. Håkon Måløy describes a worm-like attack: an attacker hides instructions in a document using white text on a white background with a tiny font size. Readers cannot see it, but Copilot can, as it removes color and font size before processing the document.

When someone uses this document as a source, Copilot executes the hidden instructions and copies them into the new file. This file then becomes a propagation vector. If this file is used as a template, the attack triggers again. A compromised market analysis from the internet could manipulate a financial report, which would then infect other reports.

Microsoft confirmed this behavior on March 31. Two attempts to fix it have failed. After 144 days, Måløy published his findings without any solution being implemented, although he withheld the payload text. AI researcher Andreas Kirsch recently joked about wishing someone would build exactly this worm to convince skeptics that the security risks associated with AI are real. Now, it exists. Prompt injections remain an unresolved security issue in the field of AI.