A self-propagating AI worm targeting Microsoft Copilot for Word was publicly disclosed today by Norwegian researcher Håkon Måløy — and every fix Microsoft shipped was bypassed within days. The attack hides malicious instructions as white text on a white background inside Word documents. When Copilot processes those documents, it silently executes the payload, alters the generated content, and copies the attack into any new file. After 144 days of coordinated disclosure, no robust fix exists for the underlying vulnerability class, putting millions of enterprise users at risk.
What Happened
The worm’s mechanics are alarmingly simple. An attacker embeds malicious instructions in a Word document as white text on a white background — invisible to humans but visible to Copilot after it strips document formatting. Victim A downloads what looks like a clean market analysis. They use it as Copilot context for a financial report. Copilot processes all document text equally, executes the hidden instructions, halves the Q1 and Q2 revenue figures in the output, and copies the payload into the new report disguised as “source metadata tracking.”
Victim B then uses that infected report as Copilot context. The cycle repeats. Source attribution collapses entirely because the visible “author” of every manipulation is Copilot itself. No phishing link, no executable — just plain text hidden in plain sight.
Microsoft has been aware since March 2026. The company shipped two patches, but both were bypassed within days by minor variations of the attack. The researcher demonstrated that the vulnerability is not a simple bug but a fundamental design flaw: Copilot treats all text in its context window as equally valid, regardless of formatting or visibility. An attacker can always re-encode the same instruction in a different invisible format (e.g., zero-width characters, font color, or metadata fields) to evade detection.
My Take
This is the kind of vulnerability that should keep every CISO awake at night. The attack requires no social engineering, no malware delivery — just a Word document that looks clean. The worm spreads through normal, trusted collaboration workflows. Your own Copilot becomes the vector.
What makes this particularly dangerous is the invisibility of the compromise. The output looks correct (except for the subtle data manipulation), and the payload propagates without any user action. Attribution is impossible because the AI itself is the “author” of every altered document. Enterprises that blindly trust AI-generated content are now at risk of internal data poisoning and cascading misinformation.
Microsoft’s inability to patch this after two attempts suggests the problem is deeper than a simple filter. The real fix may require a fundamental redesign of how Copilot interprets document context — perhaps by ignoring invisible formatting, requiring explicit permission for data transformation, or introducing provenance tracking for every token. Until then, the only safe approach is to never feed untrusted Word documents into Copilot. That’s a hard sell in a world where collaboration depends on shared files.
What to Watch
- Microsoft’s third patch and long-term strategy: Will they adopt a content provenance system, or keep playing whack-a-mole with invisible text variants?
- Enterprise adoption of AI document tools: Companies may pause or restrict Copilot for Word deployments until the risk is addressed.
- Regulatory attention: This incident could accelerate calls for AI security standards, similar to the EU AI Act’s requirements for transparency and robustness in high-risk systems.