Word's Copilot Exposed to Self-Replicating Prompt Injection Worms

A researcher documented a new attack method targeting Microsoft Word's Copilot feature that leverages self-replicating prompt injections. Hidden instructions embedded in documents propagate automatically through subsequent AI-generated content, creating a worm-like propagation mechanism. The attack operates by placing concealed commands in a file used as source material for Copilot. The AI assistant interprets these instructions as legitimate user input and copies them into the generated document. When this newly created document enters another Copilot workflow, the cycle repeats, spreading the attack independently of the original compromised file. The vulnerability was responsibly disclosed to Microsoft, which had 144 days to develop a fix. Currently, no mitigation exists that fully addresses this category of attacks.