Microsoft Patched the Copilot Worm Twice. It Still Spreads.

TL;DR

Norwegian data scientist Håkon Måløy published what he calls "among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows" in a mainstream commercial productivity suite. Hide instructions in a Word file as size 8 white text, attach that file to a Microsoft 365 Copilot drafting session, and Copilot follows them: it halves every financial figure in the report it produces, and it copies the hidden instructions into that new document in the same invisible formatting. The new document is now a carrier. He reported it on 6 March 2026 and disclosed on 28 July, 144 days later. Two mitigations shipped in between. It still reproduces.

No macro, no executable, no CVE number

The payload is text. White text, font size 8, sitting in a document that looks like a perfectly ordinary quarterly summary to a human reader. Måløy's proof of concept told Copilot to halve all financial numbers in the report it was about to generate and to keep quiet about it. Copilot obliged.

That part is not new. Cross-domain prompt injection against Copilot surfaces has been demonstrated repeatedly, and the Promptware Kill Chain paper from Brodt, Feldman, Schneier and Nassi already catalogued 21 real attacks that traversed four or more stages of a malware-style kill chain. What is new here is stage two: Copilot does not just obey the hidden instructions, it reproduces them, formatting and all, inside the document it hands back to you.

So there is a worm with no executable, no macro, and no CVE number in the writeup. The entire propagation mechanism is a strongly worded suggestion in size 8 white.

Why it propagates instead of just lying to you once

Copilot has to read every attached document to decide what is relevant. That means it reads the attacker's paragraph with exactly the same attention it gives yours, because both arrive as tokens in the same context window with no provenance attached. It is the new-intern problem: everything on the desk looks like the assignment, and nobody labelled which stack came from outside the building.

Once the generated report contains the payload, the propagation needs no attacker at all. That report is now an internal file, authored by a colleague, living in your tenant. When someone pulls it in as source material for the next draft, per Måløy's writeup the instructions "alter the new report, and copy themselves forward." The original hostile document and whatever website served it are no longer part of the chain.

Copilot found the file on its own

The detail that should worry anyone running Copilot at org scale: Måløy reports that Copilot autonomously located the malicious document in OneDrive, across a different folder, without being pointed at it. The attack surface is not "documents a user attaches." It is "documents Copilot can reach." Those are very different sets, and only one of them is under your users' control.

Affected surfaces in the disclosure are the Word "magic pen" and the newer "Edit with Copilot" experience, in an environment wired to the usual Microsoft 365 plumbing: OneDrive, SharePoint, Teams.

144 days, two mitigations, zero closure

The timeline in the disclosure is unusually legible, and it is the most damning part of the post. MSRC acknowledged the report three days in and confirmed the behavior on 31 March. The first mitigation, the new "Edit with Copilot" experience, went live 3 April and blocked the original prompt wording by 9 April. Måløy reproduced the attack the same day with a reworded payload targeting financials. The second mitigation went live 14 July: per Måløy's timeline, an upgrade of the underlying model to GPT-5.5. He reproduced the exploit against GPT-5.6 the next day, then voluntarily pushed his own disclosure date back to 28 July. It still worked.

Microsoft's statement to The Register: "We have addressed the findings reported by the researcher and thank them for working with us through coordinated vulnerability disclosure. To address this class of risk, we use a defense-in-depth strategy with safeguards that block malicious instructions at multiple points and help keep tasks aligned with users' requests."

Måløy's assessment, published the same week: "no robust mitigation for the broader vulnerability class is available," and "no customer-side remediation fully addresses the issue." Both statements can be true at once, which is exactly the problem. Microsoft fixed the reported findings. The findings were instances.

What this means if you ship anything with document context

You probably do not run Copilot for Word in production. You very likely run something with the same shape: an agent that ingests user-supplied documents, summarizes them, and writes output that someone else's pipeline later ingests. Every property of this attack transfers.

• Sanitize before the model, not after. Strip invisible formatting, zero-width characters, and off-canvas text at ingestion. You cannot ask the model to ignore text it cannot tell apart from the task.
• Treat your own generated artifacts as untrusted. This is the part almost nobody does. If a document your agent wrote can become input to your agent, you have a loop, and loops are where worms live.
• Do not count on a model upgrade as a security control. Microsoft's second mitigation was a smarter model. It survived one day.
• Constrain blast radius, not model judgment. The most useful thread in the 279-comment Hacker News discussion (361 points) converged on this: put deterministic guardrails around tool and file access rather than expecting flawless discrimination from a stochastic reader.

What the disclosure does not show

Måløy withheld the working payload deliberately, arguing that with no robust mitigation available it would be irresponsible to publish more than the vulnerability class. So there is no reproduction recipe and no quantitative success rate: the evidence is a documented timeline of successful reproductions across two mitigations and two model versions, not a measured hop count or infection rate. No CVE identifier appears in the writeup. Treat the propagation as demonstrated in a controlled environment with all current mitigations deployed, which is what the timeline supports, and not as an observed campaign in the wild.

This is part 3 of a series. Part 1 covered poisoning Copilot memory; part 2 covered instructions arriving by email. The through-line is that every channel Copilot reads is an instruction channel, whether you meant it to be or not.

Key Takeaways

• Hidden size 8 white text in a Word document can steer Microsoft 365 Copilot's output and, critically, get copied into the document Copilot generates, making that output a carrier.
• Reported 6 March 2026, disclosed 28 July 2026: 144 days, two Microsoft mitigations, and the attack still reproduced on disclosure day.
• The second mitigation was a model upgrade to GPT-5.5 per Måløy's timeline; the exploit reproduced against GPT-5.6 the following day.
• Copilot autonomously discovered the malicious file in OneDrive, so "documents the user attached" is the wrong threat boundary. Use "documents Copilot can reach."
• No macro, no executable, no CVE in the writeup. Prompt injection alone was sufficient for self-propagation inside a mainstream productivity suite.
• If your agent's output can become your agent's input, sanitize at ingestion and cap tool access. Do not expect the model to sort instructions from data.

Sources: Håkon Måløy, Context Collapse Part 3, The Register, Windows News, Hacker News discussion, The Promptware Kill Chain (arXiv), Microsoft 365 Copilot