Document-borne AI worms can self-propagate through Copilot for Word
Researchers disclosed a vulnerability in Microsoft Copilot for Word that allows hidden instructions in a document to be propagated to new documents via AI-generated edits. The attack can cause malicious prompts to spread across trusted document workflows without further attacker involvement. Microsoft has been notified, but no comprehensive mitigation is currently available.
- ▪The vulnerability enables attacker‑controlled instructions embedded in a source document to be interpreted by Copilot and copied into edited or generated Word files.
- ▪These infected documents can then serve as carriers, triggering the same behavior in subsequent Copilot‑assisted workflows.
- ▪The issue was disclosed through a coordinated 144‑day process with Microsoft’s Security Response Center and product teams.
- ▪Microsoft has reproduced the attack despite existing mitigations, and at the time of publication no robust fix for the broader class of attacks exists.
Hacker News (AI / LLM) files mainly under ai. We currently carry 2,757 of its stories.
Story provenance
Source · retrieval · rights · ranking — open for full record
inspect →
Story provenance
Attribution is not the same as permission. This drawer separates discovery metadata, excerpts, WeSearch-generated summaries, reuse status, and whether the publisher receives the visit. Nothing here claims a legal grant the publisher has not made.
Record
| Original publisher | En Klype Salt |
| Canonical URL | https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/ |
| Publication time | Wed, 29 Jul 2026 11:44:33 +0000 |
| Retrieval time | 2026-07-29T12:01:07.496Z |
| Last seen | 2026-07-29T12:01:07.496Z |
| Headline source | Publisher (no WeSearch rewrite) |
| Excerpt source | publisher body |
| Excerpt method | First ~120 words (~800 chars) of extracted publisher body, fair-use limited. |
| Summary | WeSearch · cerebras-chat (WeSearch summarizer) |
| Summary source text | contentText |
| Citation coverage | Summary is a WeSearch-generated derivative; primary citation is the original publisher URL. |
| Cluster | ttkkrO6ri9M1 · 1 stories |
| Cluster logic | Grouped by semantic title/content similarity across sources within a rolling window. Same-publisher template collisions are excluded from coverage comparison. |
| Ranking reason | Story pages are not engagement-ranked. Hub feeds use recency, with optional source-diversified chronological ordering (cap consecutive stories per source). No personalized ranking. |
| Publisher visit | Yes — open original |
| Substitutes article? | No — link-out required for full text |
Rights status (four layers)
WeSearch handling by dimension
| Indexing | May the item be indexed (stored, ranked, made findable)? | Allowed |
| Snippet | May a short excerpt of the publisher's text be shown? | Allowed |
| AI summary | May WeSearch generate its own short summary of the article? | Limited |
| Retrieval / RAG | May the content be exposed for third-party retrieval-augmented generation? | Not asserted |
| Model training | May the content be used to train AI models? | Not asserted |
| Commercial reuse | May the content be reused commercially? | Not permitted |
Basis: Derived from the published RSS/Atom feed. Contact: [email protected]. Reviewed: 2026-07-24.
Opening excerpt (first ~120 words) tap to expand
Context Collapse, Part 3 - AI Worming through Word Posted Jul 28, 2026 Updated Jul 28, 2026 By Håkon Måløy views 18 min read Context Collapse, Part 3 - AI Worming through Word Contents Context Collapse, Part 3 - AI Worming through WordI would like to thank Microsoft product teams and Microsoft Security Response Center (MSRC) for collaborating with me on this technical analysis and mitigation of the disclosed vulnerabilities. The editorial opinions reflected below are solely the author’s and do not necessarily reflect those of the organizations I collaborated with.SummaryThe findings described in this post are part of a coordinated disclosure with MSRC and Microsoft product teams.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at En Klype Salt.
Discussion
0 commentsMore from En Klype Salt
