AI Governance Institute logo
AI Governance Institute

Intelligence for Compliance and GRC Teams

← News
Research2026-07-29

Unpatched AI Worm in Microsoft Copilot for Word Can Self-Replicate Through Enterprise Documents After 144-Day Disclosure Window

Source

Context Collapse, Part 3 - AI Worming through Word

En Klype Salt / Hakon Maloy (coordinated with Microsoft MSRC)

What happened

Researcher Hakon Maloy published Context Collapse, Part 3 - AI Worming through Word on July 28, 2026, detailing a novel attack class in which malicious instructions embedded in externally sourced Word documents are interpreted by Microsoft Copilot as legitimate prompts when the AI assists with drafting new content. The worm does not require the attacker to maintain ongoing access: once a poisoned document enters an organization's document workflow, the AI silently rewrites outbound documents and appends the malicious payload to them, enabling further propagation to downstream recipients. After a 144-day coordinated disclosure period with Microsoft MSRC, the vulnerability remains unpatched against the current model version, leaving enterprises without a vendor-supplied technical control. The attack is directly enabled by the OWASP Top 10 for Large Language Model Applications LLM01 prompt injection category and highlights how agentic AI writing assistants collapse the security boundary between untrusted input documents and trusted drafting contexts. The risk profile is compounded by the broad enterprise deployment of Copilot for Microsoft 365, where documents routinely flow across organizational boundaries through email, SharePoint, and supplier portals.

Why it matters

  • ·With no vendor patch available, enterprises relying on Microsoft Copilot for Word face an active, unmitigated supply chain integrity risk: any externally sourced document processed by Copilot can become a vector for silent content manipulation and further propagation, with no reliable technical signal that an attack has occurred.
  • ·The self-replicating nature of this attack directly undermines document integrity in regulated workflows such as contract review, financial reporting, and regulatory submissions, where altered content could constitute a compliance failure or material misrepresentation without leaving a conventional audit trail.
  • ·Organizations have no vendor-supplied fix, which means risk acceptance, control compensations, or temporary deployment restrictions are required governance decisions that need to be documented, escalated, and reviewed at the appropriate level before regulators or auditors ask about them.

Governance controls affected

SEC-001Adversarial Input and Prompt Injection TestingAGT-010Agent Knowledge Source IntegritySAF-005Red-Teaming and Adversarial TestingAGT-018Agent Data Modification Blast-Radius ContainmentSAF-006Post-Deployment Adversarial Testing Cadence

What to do now

  • ☐Issue an immediate interim policy restricting Copilot for Word from processing externally sourced or supplier-provided documents until Microsoft issues a confirmed patch or architectural mitigation.
  • ☐Audit current document intake workflows to identify pipelines where untrusted external documents are routinely opened and processed with Copilot assistance, and require human review of AI-assisted drafts before those drafts are shared externally.
  • ☐Update your third-party AI vendor risk register and vendor incident notification tracking for Microsoft Copilot to reflect this unpatched vulnerability, and document the organization's risk acceptance or compensating controls in writing.
  • ☐Add this attack scenario to your AI red-teaming and tabletop exercise schedule, specifically testing whether existing output validation procedures would detect silently altered document content.
  • ☐Subscribe to Microsoft MSRC advisories for Copilot for Microsoft 365 to ensure the organization receives patch notification as soon as a fix is available, and define a maximum response window for deploying that patch once released.

What to watch next

Compliance teams should monitor Microsoft MSRC communications for any advisory or architectural update addressing this prompt injection worm, since the vendor has confirmed awareness but has not issued a fix as of the disclosure date. Broader regulatory attention to agentic AI document manipulation is likely to follow given that prompt injection is already flagged in the OWASP Top 10 for Large Language Model Applications and similar document-level injection risks have attracted increasing scrutiny across enterprise productivity suites. Teams governing agentic AI deployments should also watch for updated guidance from the EU AI Office and national cybersecurity authorities, as this attack class directly challenges assumptions about human oversight in AI-assisted document workflows.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-07-23

Hidden Characters, Visible Damage: ANSI Escape Injection in MCP Servers Can Silently Bypass Human Oversight and Corrupt Audit Logs

Bright Security has published research detailing ANSI Escape Sequence Injection (AESI), an attack class targeting Model Context Protocol (MCP) servers where invisible control characters smuggle hidden instructions into AI agent context. The attack can cause agents to take unauthorized actions, bypass human-in-the-loop review, and corrupt audit trail records. The research demonstrates automated detection methods and establishes the threat's credibility by referencing known CVEs in tools such as kubectl and Git.

Standards2026-07-15

DHS and CISA Push Mandatory Minimum Security Rules for AI Agents in Critical Infrastructure, Citing Prompt Injection and Blast-Radius Risks

A DHS-CISA analysis published in July 2026 urges federal regulators to move beyond voluntary guidance and establish mandatory minimum security requirements for AI agents deployed in critical infrastructure. The analysis calls specifically for prompt injection protections, documented human-override mechanisms, comprehensive audit logging of autonomous actions, and isolation architectures designed to limit the blast radius of a compromised agent. Sector-specific risk assessments addressing agent compromise likelihood and cascading impact are also recommended.

Research2026-07-07

Agentic AI Should Be Classified High-Risk by Default, Credo AI Research Argues, Citing Prompt Injection and Cascade Failure Exposure

Credo AI published research identifying seven novel governance considerations for agentic AI systems, arguing that autonomous agents capable of real-world action should be classified as high-risk by default. The report highlights prompt injection attacks as a severe vulnerability that can turn compromised agents into data exfiltration vectors, and warns that multi-agent architectures face compounding cascade failure risks where errors propagate undetected across interdependent tasks. Enterprise teams are advised to scope agent access levels to their security risk appetite and establish formal trust protocols for agent-to-agent interactions.