How Document-Borne AI Worms Can Self-Propagate Through Microsoft Copilot for Word

Security researchers have demonstrated that AI worms in Microsoft Copilot can silently propagate through corporate networks, turning standard document editing into an active attack vector. By exploiting indirect prompt injection, these malicious documents force the generative AI assistant developed by Microsoft Corporation to write copies of the exploit payload into new files. This discovery, published in a technical research series titled "Context Collapse (Part 3)," exposes a systemic vulnerability in how enterprise Large Language Model (LLM) agents handle untrusted data.

The Anatomy of an AI Worm in Microsoft Copilot

To understand this vector, one must understand how Microsoft Copilot for Word interacts with enterprise files. When a user opens a document and activates Copilot to summarize, rewrite, or analyze the text, the LLM reads the document's contents into its context window. If the document contains specialized, hidden instructions—known as indirect prompt injections—the LLM treats those instructions as commands rather than data.

In the scenario outlined by security research outfit Enklypesalt, the exploit goes a step further than a simple injection. The embedded payload instructs Copilot to silently append the same malicious prompt instructions to any new documents, summaries, or drafts it creates. When these newly infected documents are shared with other users on networks like Microsoft SharePoint or OneDrive, those users' Copilot instances are similarly hijacked, creating a self-propagating loop.

"The moment we give LLMs the permission to read from and write to our workspace, we transform passive text files into executable code. The document is no longer just data; it is the program."

Ultrathink Security Analysis

Why Enterprise Workflows Are Uniquely Vulnerable

This is not a theoretical bug that requires complex coding to execute. It is a logical bypass that uses the English language as its source code. Enterprise environments are uniquely vulnerable because they are designed for frictionless sharing. Modern collaborative platforms are built to index, summarize, and distribute information automatically across teams.

Consider a standard corporate workflow. An external vendor sends an invoice or proposal via email. An employee saves it to a shared folder and asks Copilot to summarize it. Under the hood, Copilot ingests the file, executes the hidden worm payload, and is instructed to inject the same payload into the user's daily status report draft. The next morning, a manager reviews that draft using Copilot, and the worm infects the manager's system, gaining access to higher-privileged documents.

This bypasses traditional signature-based antivirus software. Because the payload consists of natural language prompts rather than binary code or malicious macros, legacy security systems see nothing but standard text. The file itself does not contain a virus; it contains instructions that turn the trusted local AI into the virus creator.

The Core Flaw: Mixing Data and Control

The root of this vulnerability lies in a fundamental architectural limitation of modern LLMs: the lack of separation between the control plane and the data plane. Computer security has long relied on keeping instructions (code) separate from user inputs (data). When these two boundaries blur—as they did with SQL injection and cross-site scripting—exploits inevitably follow.

In LLMs, everything ingested into the context window is treated as tokens of equal weight. The model cannot inherently distinguish between a system instruction set by Microsoft engineers and an instruction written in italics at the bottom of a user's resume. Until LLM architectures find a mathematical way to hard-fence system instructions from input data, application-layer defenses will remain a game of whack-a-mole.

The Path Forward for Enterprise IT

For Chief Information Security Officers (CISOs), this exploit highlights the danger of deploying agentic AI tools without robust guardrails. As companies rush to integrate Copilot, OpenAI API integrations, and other agentic workflows, they are opening up massive attack surfaces.

Defending against document-borne AI worms requires several immediate operational changes:

• Isolate context windows: AI assistants should not have write-access to files unless explicitly authorized by a human click for each specific action.
• Sanitize inputs: Implement pre-processing layers that strip formatting or run heuristic checks on incoming documents to detect prompt injection patterns.
• Zero-trust AI access: Treat any output generated by an LLM that has processed external documents as untrusted, preventing it from being automatically fed into other automated business pipelines.

Takeaway

By transforming passive documents into active instruction sets, document-borne AI worms exploit the fundamental design of LLMs. In the rush to automate enterprise productivity, we have built systems that are eager to obey any voice they hear—even when that voice is whispering from inside a Word document.