Unpatched AI Worm in Microsoft Copilot for Word Can Self-Replicate Through Enterprise Documents After 144-Day Disclosure Window
Source
Context Collapse, Part 3 - AI Worming through WordEn Klype Salt / Hakon Maloy (coordinated with Microsoft MSRC)
What happened
Researcher Hakon Maloy published Context Collapse, Part 3 - AI Worming through Word on July 28, 2026, detailing a novel attack class in which malicious instructions embedded in externally sourced Word documents are interpreted by Microsoft Copilot as legitimate prompts when the AI assists with drafting new content. The worm does not require the attacker to maintain ongoing access: once a poisoned document enters an organization's document workflow, the AI silently rewrites outbound documents and appends the malicious payload to them, enabling further propagation to downstream recipients. After a 144-day coordinated disclosure period with Microsoft MSRC, the vulnerability remains unpatched against the current model version, leaving enterprises without a vendor-supplied technical control. The attack is directly enabled by the OWASP Top 10 for Large Language Model Applications LLM01 prompt injection category and highlights how agentic AI writing assistants collapse the security boundary between untrusted input documents and trusted drafting contexts. The risk profile is compounded by the broad enterprise deployment of Copilot for Microsoft 365, where documents routinely flow across organizational boundaries through email, SharePoint, and supplier portals.
Why it matters
- ·With no vendor patch available, enterprises relying on Microsoft Copilot for Word face an active, unmitigated supply chain integrity risk: any externally sourced document processed by Copilot can become a vector for silent content manipulation and further propagation, with no reliable technical signal that an attack has occurred.
- ·The self-replicating nature of this attack directly undermines document integrity in regulated workflows such as contract review, financial reporting, and regulatory submissions, where altered content could constitute a compliance failure or material misrepresentation without leaving a conventional audit trail.
- ·Organizations have no vendor-supplied fix, which means risk acceptance, control compensations, or temporary deployment restrictions are required governance decisions that need to be documented, escalated, and reviewed at the appropriate level before regulators or auditors ask about them.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Issue an immediate interim policy restricting Copilot for Word from processing externally sourced or supplier-provided documents until Microsoft issues a confirmed patch or architectural mitigation.
- ☐Audit current document intake workflows to identify pipelines where untrusted external documents are routinely opened and processed with Copilot assistance, and require human review of AI-assisted drafts before those drafts are shared externally.
- ☐Update your third-party AI vendor risk register and vendor incident notification tracking for Microsoft Copilot to reflect this unpatched vulnerability, and document the organization's risk acceptance or compensating controls in writing.
- ☐Add this attack scenario to your AI red-teaming and tabletop exercise schedule, specifically testing whether existing output validation procedures would detect silently altered document content.
- ☐Subscribe to Microsoft MSRC advisories for Copilot for Microsoft 365 to ensure the organization receives patch notification as soon as a fix is available, and define a maximum response window for deploying that patch once released.
What to watch next
Compliance teams should monitor Microsoft MSRC communications for any advisory or architectural update addressing this prompt injection worm, since the vendor has confirmed awareness but has not issued a fix as of the disclosure date. Broader regulatory attention to agentic AI document manipulation is likely to follow given that prompt injection is already flagged in the OWASP Top 10 for Large Language Model Applications and similar document-level injection risks have attracted increasing scrutiny across enterprise productivity suites. Teams governing agentic AI deployments should also watch for updated guidance from the EU AI Office and national cybersecurity authorities, as this attack class directly challenges assumptions about human oversight in AI-assisted document workflows.