Copilot for Word Can Spread a Self-Replicating Prompt

A Hidden Instruction in a Word File Can Copy Itself Into the Next One

Håkon Måløy reported a cross-domain prompt injection to Microsoft on 6 March. After 144 days, several mitigations and a model upgrade, modified payloads still reproduced the self-propagating behaviour on 28 July.

Jul 30, 2026Source: The Register

Security researcher Håkon Måløy disclosed a cross-domain prompt injection in Microsoft Copilot for Word on 29 July, under the title Context Collapse, Part 3 — AI Worming through Word. The mechanism is unglamorous and that is the problem: a document carries hidden instructions, Copilot reads them while generating a new document, and copies them into the output.

How it hides

The payload is natural language, concealed with white text on a white background at a very small font size. A human reviewing the file sees nothing. Copilot, which reads the document rather than looking at it, sees instructions.

Why it propagates

Because the generated document inherits the payload, it becomes a carrier itself. Feed that file into another Copilot-assisted workflow and the instructions fire again, spreading further — without the attacker's original document being anywhere in the chain. Documents circulate inside organisations by design; the exploit simply rides the normal flow.

144 days

Måløy reported the issue to the Microsoft Security Response Centre on 6 March 2026. Microsoft deployed multiple mitigations, including a revised "Edit with Copilot" experience and an underlying model upgrade. Måløy states that modified payloads continued to reproduce the broader self-propagating class through 28 July — the end of a 144-day coordinated disclosure window in which the specific bugs were fixed and the category was not.

Why the category resists patching

Prompt injection is not a memory-safety bug with a boundary to enforce. The model cannot reliably distinguish instructions it should follow from text it should merely process, because both arrive as language in the same context. Måløy calls this "among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite."

Why It Matters

Prompt injection has largely been demonstrated in labs and single-shot proofs of concept. Self-propagation through an ordinary document workflow, in a product deployed across enterprises, is different — and 144 days of patching that closed the instances without closing the class is the part security teams should read twice.