Microsoft Copilot Can Turn a Word File Into an AI Worm That Spreads by Itself

A researcher hid white text in a Word file and turned Microsoft Copilot into a worm that rewrites your documents and copies itself into every file it touches. Microsoft still can’t kill it. He reported it to Microsoft on March 6. After 144 days and two rounds of fixes, including a full model upgrade, the attack still runs. 🧐

The researcher is Håkon Måløy, a Norwegian AI researcher. He worked with Microsoft’s Security Response Center through a coordinated disclosure, handed them the reproduction steps, the videos, and the exact prompts, and waited. Microsoft confirmed the behavior, shipped mitigations, and upgraded the model underneath Copilot. He reproduced the attack anyway, on the newest model available, and then published.

To his knowledge, this is among the first public demonstrations of a self-copying AI worm spreading through documents in a mainstream office program. A lab experiment called Morris II showed something close in 2024, but that one lived inside AI email assistants, not the files people pass around at work. It is also the third flaw in a row he has reported in this area. The first two, poisoning Copilot’s memory and hiding instructions inside emails, Microsoft closed for good. This one it could not.

Here is what he built, and what it does if you use Copilot inside Word.

First, who the attacker is, because it is easy to mix up. The attacker is not Copilot. The attacker is whoever plants the hidden text in a document. Copilot is the tool they trick into carrying out that hidden instruction, inside your own account, with your own permissions.

Start with the hidden text. He took a normal-looking document, a fake market analysis for a mock company he built for the test and named Tfosorcim Ltd., which is Microsoft spelled backwards. At the bottom he pasted an instruction in white text on a white background, in a tiny 8-point font. You open that document and you see a market analysis. You do not see the instruction. Copilot does.

The reason Copilot sees it is simple. Before Copilot sends the text of a document to the language model, it strips the formatting. Color, font size, all of it goes away. The white text you could not see becomes plain readable text the moment it reaches the model. The instruction was never hidden from Copilot. It was only hidden from you.

The instruction was written as a JSON block, formatted so the model would treat it as part of the task instead of as content to summarize. It had two parts. The first told Copilot to change something in the document it was writing. The second told Copilot to copy the instruction into that new document, framed as a harmless note about tracking sources, and to hide it again as white text so the next person would not see it either.

Måløy is not releasing his exact wording, so attackers cannot lift a working attack straight from his report.

Now the attack.

Stage one is the foothold. Say you are writing a quarterly financial report in Word, and you pull in that market analysis as source material. Copilot reads it, follows the hidden instruction, and halves the financial numbers in your report. Then it pastes the full instruction at the bottom of your report in white text, font size 8. It says nothing about the changed numbers and nothing about the text it added. You save the report and share it, and it looks like your work, because it is your document with your name on it.

In his test the changes were deliberately obvious so he could show them, halved numbers stand out. He notes that in an actual attack the instruction would tell Copilot to shift meanings and figures in ways that slip past an attentive reviewer, and to say nothing about the change. He often had to add a line telling Copilot to highlight what it altered, because otherwise the edits were too subtle to spot. That is the part that should worry a finance team. A wrong number that looks reasonable does more damage than one that looks wrong, because it gets approved and passed on.

Stage two is where it becomes a worm. Your infected report is now the carrier. A colleague uses your Q1 report as source material for a Q2 report. The original market analysis is nowhere in sight. It does not need to be. The hidden instruction rides inside your Q1 file, triggers again, halves the numbers in the Q2 report, and copies itself forward one more time.

The word worm needs one caveat here. This one does not crawl from machine to machine by itself. It spreads only when a person, or a Copilot task set to find its own sources, pulls an infected document into Copilot again. What makes it worm-like is that once the instruction is loose inside a company’s files, ordinary work keeps feeding it forward without people meaning to.

The person behind it never touches your Microsoft 365 account. They only need to get one document in front of you, through SharePoint, through Teams, through an email attachment. And in the newer Work IQ mode you do not even have to attach the document yourself. Copilot searches your OneDrive for relevant files and can pull the poisoned document into the task on its own, from a folder you never pointed it at. In Måløy’s test it found the malicious file in a different folder from the rest of the company documents, read it, and got tricked anyway.

What makes this hard to catch is where it lives.

• → Email security does not flag it, because the document is clean on arrival. It only turns malicious when Copilot reads it.
• → Data loss tools do not flag it, because nothing is being smuggled out. The change happens inside your own logged-in Copilot session.
• → Endpoint protection does not flag it, because no program runs. There is only text, followed by an AI assistant the company already trusts.
• → Tracing it back is close to impossible, because each carrier was made by a genuine employee with a genuine account.

That is the part security people are reacting to. Once the instruction is loose inside an organization, it inherits the trust of the people passing it around. Financial reports, contracts, policies, partner documents, any of them can carry it while still looking legitimate. An affected partner can hand it to you through a shared SharePoint site, and now the entry point is a company you already trust.

It gets bigger as Copilot does more on its own. The deeper it is wired into automated document work, where it drafts, edits, and pulls in sources without a person checking each step, the more places a hidden instruction can travel, and the faster it moves.

The timeline tells its own story. Måløy reported the flaw on March 6. Microsoft confirmed it on March 31 and shipped a first fix in early April that blocked his original prompt. He reworded the prompt and it worked again. On July 14 Microsoft shipped a second fix, this time by upgrading the model under Copilot to a newer version, GPT-5.5. The next day, he reproduced the worm on the latest model available, GPT-5.6. He then offered to hold his write-up back two more weeks so Microsoft could try one more time, and Microsoft agreed. When those two weeks were up, on July 28, the attack still worked, and he published. There is no CVE number for this one. His earlier email-based finding in the same series got one, CVE-2026-55145, but this attack was disclosed at the level of the class rather than a single payload, so there is nothing single to pin a number on.

Microsoft confirmed the research and sent a statement. It said it has addressed the reported findings and uses layered safeguards that block malicious instructions at multiple points and try to keep tasks aligned with what the user asked. It encouraged people to install the latest updates, use multiple layers of protection, treat content from unknown sources with caution, and review anything an AI writes before using or sharing it.

Here is the root of the problem, and why a single patch does not close it.

A language model reads its input as one stream: your request, the system instructions, and the text of any document you hand it. They all sit in the same context and get processed together. The model has no reliable way to mark some of that text as trusted commands and the rest as untrusted data. So a sentence sitting inside a shared document can be read as an order.

He makes a sharp point about why filtering this out is so hard. To catch a hidden instruction, a detector has to understand language at least as well as the model it is protecting. The only thing that understands language that well is another language model, and then you need something to protect that one too. His view is that separating instructions from data is only part of the answer, because in daily work the line between the two is blurry. A booking procedure written inside a document is background information one minute and a set of steps the assistant should act on the next. The harder question is whether the instructions a model follows match what the user set out to do.

Some experts rate the risk lower, and that belongs in the picture too. One security researcher called it a laboratory finding that needs a chain of unlikely steps to work. He pointed out that people are trained not to open documents they were not expecting, and that the blank page holding the white text would make him suspicious before he ever fed it to Copilot. The attack is proven in a test setup. It has not been seen in the wild.

What you can do about it today, without waiting for a fix:

• → Treat any document from outside as untrusted the moment you use it with Copilot.
• → Turn off or limit Copilot’s automatic file discovery, so a human decides which documents go into a task instead of the assistant picking them.
• → Ask Copilot to show its changes as a visible redline, and have a person approve them, on anything that carries numbers or decisions.
• → Read the document Copilot produced before you share it or reuse it as a source.
• → Keep a record, in the document’s own metadata, of where its content came from and what the AI changed, so you can trace how far something spread if it does get through.

None of that closes the underlying hole. It shrinks the ways in, and it gives you a chance to notice when something looks off.

This attack works by hiding content where you cannot see it and abusing the trust you place in an ordinary file. Attackers hide data inside normal-looking files and lean on that trust to get a foothold. Learning how they do it, and how to think the way they do, is exactly what my ethical hacking course covers, from steganography and social engineering to reconnaissance, exploitation, and what comes after:

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Håkon Måløy, Context Collapse Part 3 | Morris II (arXiv) | CVE-2026-55145