Proof-of-Concept AI Worm Exploits Microsoft Copilot for Word via Hidden Text
Data scientist Håkon Måløy has disclosed a proof-of-concept AI worm targeting Microsoft Copilot for Word. The worm uses hidden white text on a white background to trick the AI assistant into self-replicating and altering documents without user consent. This discovery highlights a critical security risk in LLM-integrated office suites, where malicious prompts can propagate autonomously through document workflows. It demonstrates that traditional security patches may struggle to prevent adaptive prompt injection attacks in generative AI systems. The attack works by embedding hidden instructions that Copilot mistakes for user commands, copying the instructions into new files as they are processed. Despite Microsoft deploying multiple patches after being notified in March 2026, Måløy was still able to bypass them by modifying the prompts.
## BACKGROUND
This exploit is a form of indirect prompt injection, where an attacker embeds malicious instructions in external data processed by a Large Language Model (LLM). Unlike traditional computer worms that exploit software code vulnerabilities, AI worms manipulate the natural language processing capabilities of AI models to execute unauthorized actions and self-replicate.