Microsoft Copilot's 'Word worm' continues to function 144 days following its announcement.

      A concealed line of text in a Word document can secretly reduce the figures in your financial report by half. It can then embed a copy of itself into the clean file you share. And 144 days after a researcher alerted Microsoft, it remains effective.

      Håkon Måløy, a Norwegian data scientist, revealed this technique on July 28, following his initial report in March. Although he did not disclose the specific payload, he explained the process in detail. He considers it one of the first public demonstrations of a self-replicating “AI worm” navigating through standard workflows in a popular office suite. The Register reported on these findings this week.

      How the worm propagates

      The deception occurs in plain sight. The harmful instructions are embedded in white, eight-point text. As The Hacker News pointed out, Word removes color and font size before providing a document to the model, making the white-on-white text invisible to users but readable by Copilot.

      One instruction modifies the numbers, while the other directs Copilot to replicate the prompt in the output and conceal it as a source-tracking rule. The resulting infected output serves as the carrier. When incorporated into your work, Copilot repeats the process. The worm does not replicate autonomously; each iteration requires another drafting or editing step from Copilot, in which the contaminated file becomes part of the model's context.

      The attacker doesn't need access to your Microsoft account; Måløy stated they “only need to share a malicious document with the victim.”

      Why Microsoft cannot simply fix it

      Microsoft acknowledged the behavior in March and released two fixes. The company blocked the specific phrasing of the prompt and subsequently upgraded the underlying model to GPT-5.5. However, Måløy rephrased the payload, and it functioned again on GPT-5.6 the following day. He noted that “two mitigation attempts, including a model upgrade, did not resolve the issue.”

      His central argument pertains to architecture. A model must interpret content controlled by an attacker to assess whether it is malicious. At that point, the harmful text is already influencing its judgment.

      As he expressed, expecting the model to identify it is akin to “asking an interpreter to execute an untrusted program to determine if that program is safe.” Introducing a second model to monitor the first would merely create an “LLMs all the way down” scenario.

      Microsoft emphasizes a defense-in-depth approach that blocks harmful instructions “at multiple points,” advising customers to handle unknown content cautiously and scrutinize what Copilot generates.

      In June, the company articulated a blunt version of this position, stating that “prompting alone is not a reliable security boundary.” Its solution to AI security has largely involved deploying more AI.

      The same vulnerability exists everywhere

      The Word worm exemplifies a broader issue. Copilot trusts the content it processes. AI assistants that access your files continuously exhibit similar vulnerabilities.

      In the same week, researchers from Tel Aviv University and Intuit discussed “hallusquatting,” as reported by SecurityWeek. AI coding assistants frequently create fictitious software package names, doing so 85% to 100% of the time for some tasks.

      Malicious actors can register these names, populate them with malware, and await the AI to retrieve them onto a developer’s system. This situation reflects the finding that AI-generated code often fails to meet security standards.

      All of this unfolds as Copilot expands its usage

      The timing is unfortunate, as Microsoft is intensifying its marketing of Copilot. During this week’s earnings call, Satya Nadella announced a Copilot “super app” that integrates chat, coding, and autonomous agents into a single product, set to launch this year.

      The company claims it has over 30 million paid Copilot licenses and reports a 60% increase in Copilot revenue in a single quarter, with weekly usage now comparable to Outlook and Teams.

      Currently, even regulators scrutinizing Copilot are focused on a different concern: Microsoft’s bundling of it into Microsoft 365 and subsequent price hikes. The security conversation remains quieter and more complex.

      Måløy's advice, aside from discontinuing Copilot, is to regard every document as untrusted and to verify everything the assistant interacts with, which isn't far from doing the work independently.