AI Security Series · Part 13
The arc of this series has been walking toward this. Part 11: the tools got brilliant, the bugs stayed boring. Part 12: the tools did something that isn't boring at all. Part 13: the tools became the propagation medium.
On July 28, Norwegian researcher Håkon Måløy — a data scientist with a PhD in applied AI and ML — published a working demonstration of something previously theorized but not shown inside a mainstream product: a self-propagating worm that spreads through Microsoft 365 Copilot for Word, with no malware, no executable, and no attachment. The carrier is an ordinary business document, and the engine that spreads it is the AI itself.
How it spreads
The mechanism is two stages, and the second is the one that matters.
Stage 1 — infection. An attacker plants hidden instructions in a document — literally white text on a white background, invisible to a human reader. When Copilot is asked to draft or summarize using that document as source material, it reads the hidden text and treats it as part of the user's request. That's classic indirect prompt injection. But then it does one more thing: it copies those hidden instructions into the new document it generates.
Stage 2 — propagation. That freshly generated file is now a legitimate internal document — written by your own employee, using your own approved AI, living in your own tenant. And it carries the payload. The attacker's original file no longer needs to exist anywhere. The next person who uses this new document as a Copilot source gets infected, and their output carries it onward. The document became the worm.
The detail that makes this genuinely dangerous: the victim never attaches anything. Copilot auto-discovers relevant documents on the user's OneDrive, so an attacker doesn't need to trick anyone into opening a file — simply having a poisoned document shared into a workspace is enough for Copilot to pick it up as source material on its own.
Why "144 days" is the part that should worry you
Plenty of prompt-injection demos exist. What separates this one is that it was disclosed responsibly and Microsoft has had 144 days with it — and it still reproduces. This isn't a single researcher's unverified claim; it's been independently reported by The Register, BleepingComputer, and others.
The timeline, from Måløy's own coordination log:
- Reported to Microsoft in March 2026; the disclosure window was extended twice from the initial 90 days, reaching 144 days.
- Microsoft shipped multiple mitigations — including a model upgrade to GPT-5.5 (July 14). It didn't close the class; reproducing the worm afterward just required rewording the payload, not a new technique.
- On July 15, Måløy reproduced successful worming against GPT-5.6 — the latest model at the time — with all current Microsoft mitigations deployed, including altering financial figures in a target document.
- At publication (July 28), his note reads simply: "Attack still reproduces."
Two fixes, one of them a whole model upgrade, and the worm still runs. That's the signal.
Bug, or architecture?
This is where the story stops being about one product. Every mitigation on offer is procedural — treat external documents as untrusted, restrict what Copilot can auto-ingest, review AI-generated output before it's reused. All sensible. None of them fix the actual thing, because the actual thing isn't a bug in Copilot's code. It's that a large language model, by design, cannot reliably tell the difference between content it should analyze and instructions it should obey when both arrive in the same stream of text.
Måløy's conclusion is the uncomfortable one, and it generalizes far past Word: any system that pipes attacker-reachable content into an LLM inside a trusted workflow has to assume that content will, at some rate, be treated as commands. That's not a patch-and-move-on vulnerability. It's a property of how these systems work today. Microsoft's own framing of the broader class — is this a "vulnerability" or an inherent limitation of AI? — is telling: if it were a straightforward bug, 144 days and a model upgrade would have closed it.
What to actually do
You can't wait for a vendor patch that may be architecturally impossible. If your organization uses Copilot, Gemini, or any AI assistant that auto-ingests documents, email, or shared drives, treat these as the working assumptions:
- Treat AI-ingested content as untrusted input, exactly like you'd treat a user-supplied file in any other security context. "It's an internal document" is no longer a safety guarantee — internal documents are now a propagation path.
- Constrain auto-discovery. Understand what your AI assistant can reach without an explicit user action (OneDrive, SharePoint, shared mailboxes) and scope it down. Auto-ingestion is the feature that removes the "user opened the file" safety step.
- Keep a human in the loop for consequential actions — anything that moves money, changes figures, or sends communications. The financial-data alteration in this demo worked precisely because the output was trusted downstream.
- Don't rely on model upgrades as the fix. One was tried here and the worm survived. A better model is not a security boundary.
The through-line of this whole series: while everyone debates AI as attacker and AI as target, the quieter shift is AI becoming the medium — the thing that carries the attack from one trusted place to the next. The tools got brilliant, the tools got dangerous, and now the tools are the channel. The fundamentals — never trust input just because it arrived through a friendly door — matter more with AI in the pipeline, not less.
Sources: Håkon Måløy — "Context Collapse, Part 3" (original research, July 28, 2026), The Register, and BleepingComputer. This is a single researcher's demonstration, independently reported by multiple outlets; Microsoft acknowledges the class but characterizes remediation as ongoing.
Rolling out AI assistants across your business and unsure where the trust boundaries should sit? Talk to Sid Techno — we'll help you deploy AI tooling without turning your document library into a delivery system.