AI Worming through Word: Hidden Instructions Enable Self-Replicating Attacks
Simon Willison · rss · 2026-07-30
Security researcher Håkon Måløy discovered a new prompt injection variant targeting Copilot in Microsoft Word, which can escalate into a self-replicating worm.
How it works:
- An attacker embeds hidden instructions (e.g., white text) in a document.
- When used as source material by Copilot, the hidden instructions are interpreted as user requests, manipulating the drafted document.
- Copilot copies these hidden instructions into the resulting document, turning it into a new carrier.
- If the carrier is used in another Copilot workflow, the instructions trigger again and propagate further.
The vulnerability was responsibly disclosed to Microsoft, but no full mitigation has been deployed after 144 days.
More from Safety
- Anthropic grants METR inside access to audit its AI models and safety practices — The Decoder · 2026-10-16
- Agent actions need checks outside the model: NVIDIA demos lean on guardrails amid wave of real agent incidents — Creamy-And-Crowded · 2026-10-16
- Vitalik builds "paranoid mode" agent wrapper with Tor, zkAPI and local prompt rewriting — DavideCrapis · 2026-10-16
- Security team demos Signal 1-click exploit technique at Hexacon Paris — moyix · 2026-10-16
- China moves to impose registration and licensing on frontier AI model weights and chip designs — deanwball · 2026-10-16
- Same agent task, two auth models: shared admin login wipes 1M audit rows, per-agent identity gets refused — Prompt Engineering · 2026-10-16