Microsoft Copilot

Microsoft Copilot is an AI assistant integration embedded across Microsoft's productivity suite, including Office, Teams, and Windows, designed to help users automate tasks and generate content. For enterprise governance, Copilot raises critical questions about data residency, model transparency, and how organizations can audit AI-assisted work within their systems. Organizations must establish clear policies around when and how Copilot can be used to process sensitive information, given the potential for data flows to Microsoft's cloud infrastructure.

1 item

ResearchGlobal2026-07-29

Unpatched AI Worm in Microsoft Copilot for Word Can Self-Replicate Through Enterprise Documents After 144-Day Disclosure Window

Security researcher Hakon Maloy has demonstrated a self-propagating prompt injection attack against Microsoft Copilot for Word that enables attacker-controlled instructions hidden in externally sourced documents to alter the content of newly drafted documents and copy the malicious payload forward into subsequent files. The vulnerability remained exploitable against the latest available model after a 144-day coordinated disclosure with Microsoft's Security Response Center. Because no vendor patch is available, enterprise document-handling policies and untrusted-source controls are currently the only available mitigations.

Microsoft Copilot prompt injection AI worm AI supply chain risk agentic AI document integrity Microsoft