Microsoft Copilot Can Turn a Word File Into an AI Worm That Spreads by Itself

Mon, 03 Aug 2026 12:05:00 +0200

A researcher hid white text in a Word file and turned Microsoft Copilot into a worm that rewrites your documents and copies itself into every file it touches. Microsoft still can’t kill it. He reported it to Microsoft on March 6. After 144 days and two rounds of fixes, including a full model upgrade, the attack still runs. 🧐

The researcher is Håkon Måløy, a Norwegian AI researcher. He worked with Microsoft’s Security Response Center through a coordinated disclosure, handed them the reproduction steps, the videos, and the exact prompts, and waited. Microsoft confirmed the behavior, shipped mitigations, and upgraded the model underneath Copilot. He reproduced the attack anyway, on the newest model available, and then published.

Word on HackingPassion.com : root@HackingPassion.com-[~]

Microsoft Copilot Can Turn a Word File Into an AI Worm That Spreads by Itself