AI Worm Vulnerability Discovered in Microsoft Copilot for Word
Security researcher Håkon Måløy demonstrated a prompt injection vulnerability in Microsoft Copilot for Word that allows hidden instructions to self-replicate across documents, acting as an AI-based worm. Despite being responsibly disclosed to Microsoft, no complete mitigation for this class of attack has been deployed after 144 days. This vulnerability highlights a novel risk where indirect prompt injections can be weaponized into self-propagating malware within enterprise document workflows. It demonstrates that LLM-integrated productivity tools can inadvertently act as vectors for spreading malicious instructions without direct attacker intervention. The attack works by embedding hidden instructions in a source document that Copilot copies into new drafts, turning them into new carriers that propagate the exploit when processed in subsequent workflows. The vulnerability exploits the LLM's inability to separate data from instructions, allowing hidden text to manipulate document generation.
## BACKGROUND
Prompt injection is a vulnerability where an attacker manipulates a Large Language Model (LLM) by providing inputs that override its original system instructions. In an indirect prompt injection, these malicious instructions are placed in external data sources, such as documents or websites, which the LLM retrieves and processes. This causes the model to execute unintended actions because it cannot distinguish between developer instructions and external data.