AI Worms Begin Spreading Through Word Documents

Recently, a security study of Word Copilot demonstrated a new attack path: attackers embed malicious instructions in ordinary Word documents. When Copilot reads the files to summarize, rewrite, or generate content, it may copy those instructions into its output. The new content is then saved, shared, and processed by another Copilot instance, allowing the malicious prompt to complete another round of propagation.

Researchers call this a “document-based AI worm.”

It does not rely on VBA macros, does not require binaries to be executed on an endpoint, and does not necessarily exploit memory vulnerabilities in the traditional sense. The large language model serves as the actual “interpreter,” while the propagation vectors are the contracts, reports, meeting minutes, and proposal documents that circulate through enterprises every day.

As of July 29, publicly available information indicates that this is closer to security research and a proof of concept. There is no evidence that it has caused large-scale attacks in the real world, nor is there sufficient basis to conclude that Word Copilot has a confirmed vulnerability already being widely exploited. But the issue highlighted by the demonstration is real: when documents are both data and carriers of natural-language instructions executable by models, Office files are no longer merely passive content. They can become propagation vectors within AI workflows.

How It “Replicates” Itself

The underlying mechanism of this type of attack is still indirect prompt injection, but the researchers are not focused on making the model produce one incorrect statement in a single conversation. Their focus is on enabling malicious instructions to survive across document boundaries.

A typical attack chain can be abstracted as follows:

External document A
  ├─ Normal business content
  └─ Malicious instruction P targeting the model
            ↓
User invokes Word Copilot to summarize, rewrite, or draft
            ↓
Copilot produces a normal result while preserving or rewriting instruction P
            ↓
The result is written to document B and shared via email, cloud storage, or a collaboration workspace
            ↓
Another user asks Copilot to read document B
            ↓
Instruction P enters the model context again, completing the next round of replication

The most important change here is that prompts no longer exist only in chat input boxes. They can be hidden in the document body, appendices, comments, text with unusual styles, or other areas that the document parser sends into the model’s context. To a human, this content may appear unimportant or may even be difficult to notice. To Copilot, it may all be just a sequence of tokens waiting to be processed.

An attacker’s goal is generally not as simple as inserting the phrase “ignore previous instructions.” A payload capable of propagation must accomplish at least two things:

1. Influence the current task: Induce the model to treat data in the document as operational instructions rather than material to be analyzed.
2. Preserve itself: Instruct the model to reproduce equivalent instructions in a summary, rewritten draft, or new document so that the next model invocation can still read them.

If a payload can only alter a single response, it is merely an ordinary prompt injection. If it can reliably enter a new, shareable document, it gains worm-like replication characteristics.

This Is Not a Traditional Worm, but the Name Is Not Much of an Exaggeration

Traditional computer worms use executable code and software vulnerabilities to scan, infect, and run autonomously, often without user involvement. The “worm” in the Word Copilot scenario is not yet that autonomous: users generally still need to open the file, invoke Copilot, and save or send the result.

A more accurate description would therefore be a human-assisted semantic worm.

What it propagates is not machine instructions, but behavioral constraints expressed in natural language. Every time the model reads the document, it effectively reinterprets the payload. The user’s actions—summarizing, rewriting, generating, and sharing—perform the propagation on its behalf.

This distinction is important. It means traditional malware detection may not identify the problem: the file contains no macros, no shellcode, and no known malicious hashes. Every passage may even be completely normal from a grammatical perspective. Antivirus software sees a document, while the large language model may see a set of task instructions.

Calling it a “worm,” however, is not merely an attempt to generate attention. As Word and other office agents gain stronger capabilities to write, save, reference, and distribute content, the amount of human involvement required for propagation will continue to decline. Today, users must click “Summarize” and “Insert.” Tomorrow’s document agents may rewrite, archive, and distribute an entire report automatically.

As Copilot evolves from a sidebar chat interface into an in-canvas agent, its value comes from “taking action on the user’s behalf”—and the risk comes from exactly the same place.

Why Word Is a Dangerous Environment for Propagation

Word files have three inherent advantages within enterprises: trust, longevity, and high mobility.

Contracts flow from legal departments to procurement teams and suppliers. Proposals are repeatedly revised among sales, product teams, and customers. Meeting minutes enter knowledge bases, while quarterly reports may be reorganized into emails, presentations, and executive summaries. A single file is often processed repeatedly by dozens of people, multiple systems, and different models.

In the past, this mobility primarily created risks involving macro viruses and phishing. Copilot now adds a new execution environment to documents.

Of particular note, Microsoft 365 AI workflows are expanding the scope of their context. Copilot no longer processes only the current paragraph; it can generate new content by synthesizing multiple documents, emails, and meeting records. Multi-file referencing is highly beneficial for productivity, but it also means a single contaminated source may enter a much larger context and influence otherwise clean output.

Propagation does not necessarily involve verbatim copying. The model may abbreviate, translate, or reorganize malicious instructions. As long as the semantic objective is preserved, conventional string matching and hash-based detection can easily fail. This is one reason semantic payloads are more troublesome than macro code: they can mutate.

The Real Danger Is Not “Making the Summary Weird”

If an attack merely causes Copilot to append an irrelevant paragraph to a summary, its impact is limited. More realistic risks arise when it is combined with enterprise data, identities, and tool permissions.

1. Contaminating Subsequent Documents

An injected model might add incorrect terms to a contract summary, downplay risks in an audit report, or insert attacker-specified content into an external-facing proposal. Because the result appears to have been generated by Copilot from an official document, it is more likely to be trusted than text in an unsolicited email.

2. Entering Enterprise Knowledge Bases

Many teams directly write Copilot-generated summaries, FAQs, and meeting minutes into SharePoint, OneNote, or internal RAG knowledge bases. Once contaminated content is persisted, it may be repeatedly retrieved for weeks or even months.

At that point, the unit of propagation is no longer a single Word file, but the entire knowledge workflow.

3. Inducing Unauthorized Actions

Word Copilot alone cannot somehow bypass Microsoft 365 permission boundaries. It can access only data that the current identity is already authorized to read, and this point should not be exaggerated.

However, when Copilot or third-party agents can invoke email, cloud storage, knowledge bases, and external connectors, a malicious document may attempt to induce them to retrieve additional information, generate outbound content, or execute tool calls. Prompt injection is not itself privilege escalation, but it may turn a user’s existing permissions into an attack path.

4. Continuing to Spread Through Trusted Identities

Files received from a colleague’s email address, a project group, or an enterprise SharePoint site are generally more likely to be opened than external attachments. Once a contaminated document enters an internal collaboration space, subsequent propagation carries the endorsement of organizational trust. For attackers, this is more effective than sending unsolicited attachments in bulk.

What Conditions Are Required for the Attack to Work?

This type of research deserves attention, but it should not be portrayed as “opening Word causes an infection.” Stable propagation requires at least the following conditions to be met simultaneously:

• Copilot’s document-parsing pipeline must be able to read the malicious text;
• The model must fail to reliably distinguish document data from system instructions;
• The malicious instructions must receive sufficiently high priority when competing with the user’s task;
• The generated result must be written into a new persistent document rather than remaining in a temporary response;
• The new document must continue through workflows involving other users or agents;
• Security filters, human review, and permission confirmations must fail to interrupt the chain.

Many Copilot operations are still initiated manually by users, which slows propagation and leaves room for review. Different model versions, tenant configurations, document formats, and security policies can also significantly affect the attack’s success rate.

In other words, this is more like a proven attack primitive than a fully developed automated worm capable of sweeping across the internet.

“The User Remains in Control” Does Not Mean the Problem Disappears

Microsoft’s standard description of Office AI features is that the AI responds only when users choose to invoke it, while existing privacy and security settings continue to apply. These restrictions are valuable, but they cannot fully address document-based prompt injection.

A user clicking Copilot proves only that the operation was user-initiated. It does not prove that the model is performing the task the user actually intended. The problem occurs after the click: Can the model identify untrusted instructions in the context? Will it carry those instructions into its output? Will it trigger downstream tools?

This is somewhat similar to cross-site scripting in browsers. A user intentionally opening a webpage does not mean every script on that page should receive the same level of trust. Likewise, a user intentionally summarizing a document does not mean every sentence in that document should be treated by the model as a command.

“Whether to invoke AI” and “whom the AI should obey” are two different security questions.

Simply Telling the Model “Do Not Obey the Document” Is Far from Enough

The most direct defense is to tell the model in the system prompt that document content is untrusted and that it must not execute instructions found there. This can reduce the success rate of some attacks, but it does not provide a reliable security boundary.

Natural language does not provide absolutely reliable instruction isolation. Attackers can bypass simple rules through role-playing, encoding, translation, long-context interference, and multi-turn assembly. After a model upgrade, defensive prompts that previously worked may also become ineffective.

Keyword filtering is equally insufficient. A real payload can be paraphrased with synonyms and does not need to contain obvious terms such as “ignore,” “system prompt,” or “copy yourself.” Moreover, legitimate technical documentation may itself discuss prompt injection, so all content containing related terms cannot simply be blocked.

Effective defenses must exist outside the model.

What Microsoft and Office Agents Need to Add

Layer One: Clearly Distinguish Data from Instructions

Document parsers should attach trust labels to content from different sources. Direct user input, administrator policies, internal templates, and external attachments must not occupy the same hierarchy within the context. The model may understand document content, but commands within that content should not be directly elevated into agent behavior.

Layer Two: Track Content Provenance

Every key conclusion and operational instruction in generated content should be traceable to its source. If the output includes instructional text from an external document, the system should flag or block it rather than silently writing it into a new file.

This is similar to taint tracking in programming-language security: untrusted input may participate in computation, but it must be inspected before entering execution, external transmission, or persistence stages.

Layer Three: Restrict High-Risk Actions

Reading and summarizing are one class of permissions; writing, sharing, sending email, and invoking connectors are another. Copilot should not receive implicit authorization to send content externally merely because the user allowed it to read a document.

Actions such as cross-file writing, bulk modification, sending attachments externally, and accessing sensitive data should require separate confirmation, with the system showing users what triggered the action and where the data originated.

Layer Four: Detect Propagation Loops

If an anomalous instruction repeatedly appears across multiple documents and generated outputs, the platform should be able to identify replication chains with high semantic similarity. Even when the text has been rewritten by the model, vector similarity, provenance graphs, and behavioral logs can still be used to detect abnormal propagation.

What Enterprises Can Do Now

Enterprises do not need to disable Copilot because of a single proof of concept, but they should stop treating AI-generated output as inherently trustworthy.

The following measures can be prioritized:

• Mark external Word files, PDFs, and email attachments as untrusted AI context;
• Retain complete audit logs for summarization, rewriting, and generation tasks triggered by external documents;
• Prevent agents from automatically sending generated results externally, especially through email, shared links, and cross-tenant transfers;
• Preprocess and scan hidden text, anomalous styles, comments, and document metadata;
• Do not write Copilot-generated content directly into enterprise knowledge bases without review;
• Use separate permissions and controlled connectors for highly sensitive areas such as finance, legal, and human resources;
• Monitor for identical or highly similar instruction fragments repeatedly appearing across multiple files;
• Add scenarios in which “documents can also inject instructions into AI” to employee training, rather than covering only phishing links and macro viruses.

Developers of custom RAG systems or document agents should also avoid unreviewed closed loops of “retrieve—generate—automatically write back—retrieve again.” Any model output that will enter the next round of context should be treated as new untrusted input rather than automatically receiving a higher level of trust merely because it was generated by a model.

Documents Are Evolving from Content Containers into Program Interfaces

The most valuable aspect of this research is not that it proves an invincible worm has appeared in Word, but that it reveals how the security model of office software has fallen behind the products themselves.

In the past, documents were data and macros were code, with at least a relatively clear boundary between the two. After large language models entered Office, natural language began serving three roles simultaneously: content, instructions, and control logic. If the system cannot determine whether a sentence is describing an operation or requesting that the operation be performed, “context collapse” occurs: all text is compressed into the same prompt space, causing trust boundaries to disappear.

In the short term, Word Copilot worms still depend on user involvement, and their propagation efficiency cannot match that of traditional network worms. But the direction of travel is more concerning than the current demonstration. As office agents gain persistent operation, cross-application access, and automated distribution capabilities, today’s indirect prompt injection may evolve into a true workflow worm.

Word documents do not automatically become malware merely because they are connected to AI. From now on, however, enterprises should indeed manage them as a form of potentially executable context.

References

• M365 Copilot: How Word Agents Are Reshaping Document Workflows—An introduction to the product evolution of Word Copilot from sidebar Q&A to in-canvas agents, as well as the changes to its document-writing capabilities.