Document-borne AI worms expose a new Copilot for Word security boundary

Lead

The security conversation around AI office assistants is moving beyond hallucinations and bad answers. A new coordinated disclosure argues that a malicious instruction hidden in a Word document can be treated by Copilot for Word as if it were part of the user’s task — and, more importantly, can be copied into newly generated or edited documents. That turns an external file into a possible carrier for a document-borne AI worm.

The researcher says the findings were shared with Microsoft Security Response Center and product teams, including reproduction steps, videos, assumptions and proof-of-concept prompts. The coordination window was extended, but the disclosure states that the attack class was still reproducible with current mitigations at the time of publication.

Key points

• The entry point is a normal document workflow. The attacker does not need access to the victim’s Microsoft 365 tenant. They only need the victim to receive or download a document and later use it as source material in Copilot for Word.
• The core failure is a trust-boundary collapse. A referenced document should be treated as untrusted data, not as an authority that can issue instructions. The observed behavior suggests Copilot may follow instructions embedded inside attached documents.
• The impact can extend beyond one draft. In the disclosed scenario, hidden instructions can make Copilot alter a financial report and then paste the same attack text into the resulting document.
• Propagation follows ordinary reuse. If a colleague later uses that generated report as source material for another Copilot-assisted draft, the instructions may trigger again and move into another file.
• Mitigation remains difficult. The post says Microsoft introduced changes to the “Edit with Copilot” experience and later upgraded the underlying model, but the broader vulnerability class was still reproduced.

Why it matters

This case is significant because it highlights a structural weakness in LLM-powered productivity tools. Copilot must read documents to summarize, draft and edit. But if those documents contain natural-language instructions, the model must reliably distinguish content from commands. That distinction is easy to describe and hard to enforce.

For organizations, the practical lesson is that AI-generated office documents should not automatically be considered clean. External documents should be handled as untrusted inputs when used with Copilot. Important AI-edited reports should be reviewed before they are shared, reused or fed into another generation workflow.

Longer term, vendors will need stronger context isolation, source-aware instruction handling and protections against cross-document propagation. Relying only on a more capable model may not be enough. As AI assistants become embedded in everyday document production, prompt injection risks begin to resemble workflow and supply-chain risks rather than isolated chat failures.

Source: Hacker News