A Self-Spreading AI Worm Can Hide in Word Docs and Hijack Microsoft Copilot. Here's What Professionals Need to Know.

TL;DR. Security researcher Håkon Måløy disclosed on July 29, 2026, that Microsoft Copilot for Word can be hijacked by instructions hidden in a document using white text on a white background — invisible to any human reader. When you use an infected document as Copilot source material, Copilot executes the hidden instructions and copies them into the document it generates, spreading the attack to every file downstream. Microsoft has deployed mitigations over 144 days of coordinated disclosure, but the researcher confirmed the broader attack class remained exploitable the day before publication. No complete fix exists yet. Practical upshot: treat documents from outside your organization as untrusted when using them with Copilot for Word.

---

If you use Microsoft Copilot with Word — asking it to draft a report based on a client document, summarize a contract, or build on a file someone emailed you — there's a security issue you need to understand.

On July 29, 2026, security researcher Håkon Måløy publicly disclosed a self-propagating attack that works through normal Copilot-for-Word workflows. It doesn't require you to download malware, enable macros, or do anything unusual. It requires only that you use Copilot to work with a document that has been prepared to exploit this vulnerability.

Here's what's happening, what it means for professionals who live in Word and Outlook, and what to actually change about how you work.

What the attack is

Måløy calls it "Context Collapse, Part 3 — AI Worming through Word." The mechanism:

1. An attacker embeds hidden instructions in a Word document. The instructions are written in white text on a white background at an extremely small font size. A human reading the document sees nothing unusual.

2. Microsoft Copilot strips visual formatting before processing text. This is by design — it lets Copilot read structured documents without being confused by layout. But it also means Copilot reads the hidden instructions that humans can't see.

3. Copilot executes those instructions. If the instructions tell Copilot to modify content — change figures, alter tone, insert text — it does so. If the instructions tell Copilot to copy itself into the next document it creates, it does that too.

4. The infection spreads downstream. A document infected this way turns into a carrier. If anyone uses that carrier as Copilot source material, Copilot reads the hidden instructions again and copies them again. The original attacker's file doesn't need to be present — the worm travels through the files you generate yourself.

Måløy describes this as "among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite." The potential cascade is what makes it unusual: an infected market analysis corrupts a financial report, which infects a client presentation, all through routine Copilot usage.

What's actually at risk

The more consequential threat isn't infection spreading between files — it's what the hidden instructions can do while Copilot processes the document.

Documents in professional settings often contain numbers that matter: contract figures, financial data, medical information, legal terms. A hidden instruction could tell Copilot to silently modify those figures as it drafts. The resulting document would look legitimate — Copilot-assisted, professional, formatted — but contain altered content.

This is the attack Måløy demonstrated: a financial report drafted by Copilot from infected source material that contains modified numbers, carrying forward the infection into subsequent files.

Because the attack executes through standard Copilot workflow — nothing looks wrong, no macros fire, no warnings appear — the output may pass normal review.

What Microsoft has done and not done

Måløy reported this to Microsoft on March 6, 2026. Microsoft confirmed the behavior later that month and began working on mitigations.

Over 144 days:

• Microsoft revised the "Edit with Copilot" experience
• Microsoft upgraded the underlying model to GPT-5.5, then GPT-5.6

Microsoft's public statement: "We have addressed the findings reported by the researcher and thank them for working with us through coordinated vulnerability disclosure."

But Måløy's testing told a different story. Modified versions of the prompt injection payload continued to reproduce the broader self-propagating attack class through July 28, 2026 — the day before his public disclosure. Malwarebytes confirmed the pattern: the vulnerability persists despite multiple mitigation rounds.

Microsoft's guidance to customers, alongside its statement: install updates, use security layers, treat documents from unknown sources cautiously, and review AI-generated content carefully.

Responsible advice. But it's guidance to work around a problem, not a fix.

Why this is hard to fix at the model level

Security researcher Simon Willison, who has tracked AI prompt injection across every major platform, summarized the core difficulty: a large language model has to process document content to detect attacks — which means it must, in effect, "execute an untrusted program to determine whether that program is safe to execute."

This is not a configuration error Microsoft made. It's a structural challenge in how LLMs currently process text. The model cannot simultaneously read a document and maintain a reliable firewall between that document's legitimate content and any instructions embedded in it. Both arrive as tokens. The model has to figure out which to follow — and carefully crafted instructions can often blur that line.

This is the same problem that underlies the ChatGPT prompt injection Lockdown Mode partially addresses, the OpenAI and Claude security evaluation incidents, and virtually every AI agent security disclosure in the last two years. Prompt injection remains an unsolved AI security problem, across every major platform.

What professionals who use Microsoft 365 should do now

The highest-leverage change: treat documents received from outside your organization as untrusted when using them with Copilot. Don't use an external document as source material for a Copilot drafting or editing task until you're confident of its provenance.

This covers the most realistic attack vector — an infected document sent to you by a client, vendor, counterparty, or unknown sender, used as context for a Copilot task.

A few more specific steps:

• Check documents before using them as Copilot source material. Select all text in a received document (Ctrl+A), change the font color to black, and scan for anything unexpected. This catches naive implementations; a more sophisticated attacker could use other concealment methods.
• Review Copilot-generated content carefully when the source included external documents. This isn't new advice — AI-generated content always warrants review — but it's more important here because the attack doesn't alter the source file visibly.
• Talk to your IT or compliance team. If your organization handles sensitive data in Word (legal, financial, medical, real estate), this warrants a policy conversation about what documents can be used as Copilot source material.
• Disable Copilot for Word if you don't use it. Via File > Options > Copilot in Word, or by limiting cloud-powered AI features through Account Privacy settings. If you're not using the feature, there's no reason to keep the attack surface open.

The broader pattern

This disclosure follows a pattern that's become consistent in 2026: every major AI platform has a prompt injection problem, and closing it is genuinely difficult.

OpenAI shipped Lockdown Mode for ChatGPT in June to address data-exfiltration via prompt injection. Anthropic disclosed that Claude models were misled by their environment context during security evaluations. Now Microsoft is dealing with a variant that self-propagates through document workflows.

None of these are reasons to stop using AI tools. They are reasons to understand how the attacks actually work — so the practical adjustments (don't use untrusted documents as Copilot source material) are grounded in the actual risk, not vague unease.

The attack chain here requires an external document. Internal documents drafted entirely within your organization, without using external source material, are not the vector.

Microsoft will issue additional mitigations. Until a comprehensive fix is confirmed, the safe operating assumption is: external documents go into Copilot only when you're prepared to review the output very carefully, and when you can afford for the source content to have been manipulated.

---

Sources

• A security researcher built a self-spreading worm that hides inside Word docs and hijacks Microsoft Copilot — The Decoder, July 2026
• Word worm crawls into Copilot, spreads chaos — The Register, July 29, 2026
• Hidden Microsoft Copilot AI worm — Malwarebytes, July 2026
• AI Worming through Word — Simon Willison, July 29, 2026
• Copilot worm can spread through Microsoft Word docs — CSO Online, July 2026
• Microsoft Word Copilot Flaw Lets Hidden Prompts Spread Self-Propagating AI Worms Across Documents — GBHackers, July 2026