A newly disclosed vulnerability allows a self-replicating "AI worm" to spread through Microsoft Word documents by exploiting Copilot as a transmission channel, according to a report published Tuesday by Norwegian AI researcher Håkon Måløy and later confirmed by Microsoft. An attacker can hide instructions inside a document that later serves as source material for Copilot-generated or Copilot-edited files — for instance, as input to a financial report. Those hidden instructions can alter figures in the document being created, then copy themselves into the new file, turning it into a carrier when used in another Copilot-assisted workflow. Måløy called it "among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite."
The vulnerability sidesteps nearly every defensive mechanism enterprises currently deploy, according to Aman Mahapatra, chief strategy officer at Tribeca Softtech, who reviewed the attack mechanisms. The worm bypasses email security controls because the document isn't malicious on delivery and only becomes harmful when Copilot processes it. It evades data loss prevention tools because exfiltration occurs through the user's own authenticated Copilot session, and it circumvents endpoint protection because no code executes — only instructions get followed by an AI service the enterprise has explicitly authorized. Måløy has been working with the Microsoft Security Response Center since March 3, and Microsoft has rolled out multiple small focused mitigations, but the core vulnerability remains unfixed. Microsoft stated Thursday that it has "addressed the findings reported by the researcher" and uses "a defense-in-depth strategy with safeguards that block malicious instructions at multiple points."
The attack exploits a fundamental limitation of large language models: their inability to reliably distinguish between data offered as input and instructions they're meant to execute. Multiple security experts compared the problem to SQL injection attacks that plagued databases decades ago, which were eventually solved through parametrized binding that separates instructions from data. "The same needs to happen with LLMs and other AI," said Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group. Mike Leone, a principal analyst at Moor Insights & Strategy, put it more bluntly: "Thirty years later, we've built an entire category of software that can't tell the difference at all." Måløy noted that the coordinated disclosure process showed that mitigations can meaningfully reduce the attack surface, making attacks less reliable and limiting their reach, even without completely eliminating the underlying problem.
Several experts offered interim tactics while the industry works toward a deeper fix. Frank Dickson, group VP for security at IDC, said the most useful lever sits outside the model entirely, in how much untrusted content Copilot is allowed to pull into a session without a human selecting it. Enterprises can turn off Copilot's auto-discovery behavior or restrict it, requiring humans to explicitly choose which documents to feed it — which closes off one of the two ways the attack gains a foothold. IDC also recommended requiring a visible diff or redline of anything Copilot changes in consequential documents, with a human approving the changes, and tracking in metadata where content came from and what an AI system touched. However, Tyler Reguly, Fortra's associate director of security R&D, argued the vulnerability requires "a perfect storm" to exploit, noting that normal enterprise workflows don't include the necessary steps and people are trained not to download Word documents from untrusted sources. Still, Dickson warned that because carrier documents are created by legitimate employees using legitimate tools, there's no obvious point of origin once the payload starts moving — meaning an organization could be laundering corrupted financial figures through its own workflow for weeks before anyone notices.