A Word document you receive from a colleague, a vendor, or a stranger can now carry a payload that quietly rewrites your files and spreads itself onward through Copilot for Word, even after Microsoft shipped two mitigations. Norwegian researcher Håkon Måløy published the proof of concept on July 28, 2026 after a 144-day coordinated disclosure with the Microsoft Security Response Center, and his July 15 tests reproduced the worm with GPT-5.6, the latest model available to him at the time (En Klype Salt: Context Collapse, Part 3). The Register reported the disclosure and Microsoft’s response on July 29 (The Register).
For anyone who treats Word as a passive document tool, this is the moment that assumption breaks. The attack does not need the sender to compromise your Microsoft 365 tenant and does not rely on macros. It requires a hostile document to be used as source material in a Copilot-assisted Word workflow.
How the worm works
Måløy’s technique is a prompt-injection payload dressed up as document formatting. The attacker hides instructions in a Word file as small white text on a white background, or otherwise styled to be invisible to a human reader, formatted as a JSON-style directive. The visible body of the document can read normally (En Klype Salt: Context Collapse, Part 3).
The reason the trick works is the way Copilot for Word processes a document. Måløy notes that “Copilot for Word strips all text formatting like color and font size before passing the text into the underlying Large Language Model.” Once the formatting is gone, the hidden instructions look identical to ordinary prompt text to the model. They reach the LLM as live instructions rather than inert content (En Klype Salt: Context Collapse, Part 3).
The payload has two halves. One half tells Copilot to mutate the document the victim is producing, for instance by altering financial figures. The other half tells Copilot to append the same hidden instructions to the newly written document in the same white-text, font-size-eight style. The next person who picks that file up and uses Copilot on it gets the same instructions fed to the same model, and the cycle repeats without further action from the original sender (En Klype Salt: Context Collapse, Part 3).
Måløy frames the danger in plain terms: “The attacker does not need access to the victim’s Microsoft 365 tenant. The attacker only needs to share a malicious document with the victim” (En Klype Salt: Context Collapse, Part 3). The essential condition is that the malicious document enters a Copilot-assisted workflow.
What Microsoft did, and what it did not do
The disclosure was a long back-and-forth. Måløy submitted his initial report to MSRC on March 6, 2026; Microsoft acknowledged it on March 9 and confirmed the behavior on March 31. The first Copilot-side mitigation went live on April 3 in the “Edit with Copilot” experience, and by April 9 his original payload was no longer reproducing. Within a day, he had rebuilt the attack using a different cross-prompt injection task that manipulated financial numbers, and MSRC opened a second case (En Klype Salt: Context Collapse, Part 3).
At Microsoft’s request, the public disclosure was pushed from late spring to July 15, then again to July 28. A second mitigation shipped on July 14 with a model upgrade to GPT-5.5. By July 15, Måløy had reproduced the worming behavior against GPT-5.6. The researcher and Microsoft agreed on a July 28 publication date. As of July 15, the worm reproduced with the mitigations then deployed (En Klype Salt: Context Collapse, Part 3).
Microsoft’s public statement, given to The Register, is that it “addressed the findings reported by the researcher” and described a “defense-in-depth strategy with safeguards that block malicious instructions at multiple points.” The company encourages customers to install updates, layer security tools, treat unknown content cautiously, and review AI-generated output before sharing (The Register). Måløy’s read is more pointed: “Two mitigation attempts, including a model upgrade, did not close the class” and “no customer-side remediation fully addresses the issue at the time of publication” (En Klype Salt: Context Collapse, Part 3).
This is not a one-off curiosity. Simon Willison, who has tracked prompt-injection research for years, called it “the first one I’ve seen that deliberately copies instructions to self-replicate itself” (Simon Willison: AI Worming through Word). The closest academic precedent is the Morris ii worm, a paper published in 2024 that demonstrated self-replicating prompt propagation in GenAI email-assistant ecosystems (arXiv:2403.02817). The broader pattern matches what Unit 42 caught in 22 prompt injection techniques weaponized in the wild earlier this year.
What This Means
The deeper lesson is not that Copilot is uniquely broken. Måløy makes the general point clearly: “Any system that integrates an LLM into a trusted workflow today must assume that attacker-controlled content entering the model’s context will result in compromise at some rate.” He compares relying on the model to detect its own malicious instructions to “asking an interpreter to execute an untrusted program to determine whether that program is safe to execute” (En Klype Salt: Context Collapse, Part 3). Recent benchmark work backs that pessimism up: every LLM self-defense eventually broke across 20,000 attacks, with only hard-coded output filtering holding the line.
For ordinary Copilot users, the practical mitigation is uncomfortable: treat every externally sourced document as untrusted input, fully review attached files before sending them to Copilot, and carefully review anything Copilot produces before forwarding it. The risk is highest in workflows where Copilot generates financial figures, summaries, or contracts from shared templates - exactly the cases where the tool feels most useful (En Klype Salt: Context Collapse, Part 3).
For organizations, the episode argues for treating AI assistants inside productivity suites as an exposure layer rather than a productivity feature. A document channel that used to carry text now carries executable prompts, and the controls most IT teams have for spam, phishing, and macro viruses were not built for that.
The Bottom Line
Microsoft Copilot for Word can carry a self-replicating prompt-injection worm that survived two mitigation attempts in the researcher’s tests. The original research was published July 28, 2026 after a successful July 15 reproduction with GPT-5.6. Until Microsoft ships a mitigation that closes the broader class, treat any Word file entering a Copilot workflow as untrusted code.