Independent researcher Håkon Måløy published “Context Collapse, Part 3: AI Worming through Word” on July 28-29, capping a 144-day coordinated disclosure with Microsoft’s Security Response Center (MSRC). The finding: Copilot for Word can be turned into a self-propagating carrier. A single document with hidden natural-language instructions is enough to start a chain in which every new document Copilot drafts or edits from that source inherits the payload — and goes on to infect the next one.

What’s broken

The bug is a cross-domain prompt injection (XPIA) problem baked into how Copilot for Word processes source material. When a user asks Copilot to draft or edit a document using an existing file as reference, Copilot strips the file’s formatting before feeding the text into the model’s context. That strip step destroys the visual cues a human would use to spot something wrong — including white-on-white text set in a near-invisible font size — but leaves the text itself intact. The model reads the hidden text as plain input and, because there is no reliable boundary between “data to summarize” and “instructions to follow,” treats it as part of the user’s request.

The attack payload does two things once active: it alters the content Copilot generates in the current session (Måløy’s PoC demonstrated changing figures in a business document), and it appends a copy of itself back into the newly created file as hidden white-on-white text. If that new document is later fed into another Copilot-assisted workflow — shared with a colleague, used as a template, uploaded to a repository of “reference” documents — the cycle repeats with no attacker infrastructure and no further action required. This is architecturally the same self-propagation model as a classic worm, just running on natural-language instructions instead of executable code.

Disclosure timeline

  • March 6, 2026 — Måløy reports the issue to MSRC.
  • March 9 — MSRC acknowledges and opens a case.
  • March 31 — Microsoft confirms the reported behavior; mitigation work begins.
  • April 3 — First mitigation ships.
  • April 9 — The original PoC wording is confirmed blocked, but a reworded XPIA prompt reproduces the full attack.
  • July 14 — Second mitigation ships: Copilot’s underlying model is upgraded to GPT-5.5.
  • July 28-29 — Måløy publishes, having reproduced the attack class again post-upgrade (and subsequently against GPT-5.6) with modified prompt wording. He states no comprehensive mitigation exists for the underlying vulnerability class.

Microsoft’s XPIA classifiers — the guardrail meant to distinguish injected instructions from legitimate content — have blocked each specific proof-of-concept phrasing Måløy submitted, but not the general technique. Every fix so far has been a pattern-match against a known payload, not a structural fix to the fact that Copilot has no hard boundary between “referenced document content” and “instructions.”

Impact

There’s no CVE tied to this disclosure and no evidence of in-the-wild exploitation — this is coordinated research, not an active campaign. But the blast radius is anyone using Copilot for Word against externally sourced or shared documents: contract templates pulled from a vendor, RFP responses, boilerplate policy documents, anything drawn from a shared drive or received by email and then used as “reference material” in a Copilot session. In an enterprise where templates and reference docs circulate widely, one seeded document can propagate through Copilot sessions across teams without ever touching email attachments, macros, or any channel that existing content-security tooling inspects. Because the payload rides inside the model’s context rather than the document’s executable surface, traditional AV/DLP scanning of the file itself won’t catch it — the document looks like a normal Word file to anything that isn’t parsing it the way Copilot does.

The broader significance is architectural: this is the same class of flaw behind EchoLeak (CVE-2025-32711) and other Copilot/M365 prompt-injection findings — the lack of a trust boundary between document content and model instructions — but this is the first public demonstration that the flaw supports genuine self-propagation rather than one-shot data exfiltration or content tampering.

Mitigation

Microsoft has not published a comprehensive fix, so treat this as an open risk in any Copilot-for-Word deployment:

  • Restrict Copilot’s ability to ingest externally sourced documents (email attachments, downloaded templates, files from outside your tenant) as reference material where feasible.
  • Audit high-circulation templates and “master” documents for hidden text — check for white-on-white or near-invisible-size runs, especially in files that get reused across teams as Copilot source material.
  • Treat any document that has passed through an external party and is subsequently used as Copilot reference input as untrusted, the same way you’d treat an executable from an unknown source.
  • Watch Microsoft’s MSRC advisories and Message Center for follow-up mitigations; this is an active, unresolved disclosure and further model-side patches are likely.
  • If your org has DLP or content-inspection tooling, evaluate whether it can be extended to flag hidden/invisible text runs in Office documents, since this is currently a blind spot for most scanning pipelines.

Sources: The Hacker News, The Register, Simon Willison’s writeup, Måløy’s original disclosure, CSO Online.