A researcher managed to make one Word document infect the next one. Microsoft has had 144 days, two rounds of patches, and a new model to fix it, yet the exploit still works.

by Tim Leogrande, BSIT, MSCP, Ed.S.

🗓 AUG 6 2026 • 3 MIN READ

📰 NEWS

Beware of untrusted documents. An attacker can embed malicious instructions within a Word document so that if that document is fed to an AI platform like Copilot for a summary of its contents, the instructions may change the information that was read from the original document so it’s incorrect in the summary. Then those same malicious instructions can be copied into the summary.

Norwegian AI researcher Håkon Måløy published details of the issue on July 28 in a blog post. While he didn’t release the prompt payload he used to demonstrate the issue, he provided details about how the exploit works, explaining that due to a lack of a good mitigation strategy, he believes it would be irresponsible to publish more than a description of the class of vulnerability.

Måløy reports he has been working with Microsoft on the issue since March 6, and while two rounds of patches have been released to Copilot, including a July 14 update that swapped in a new model, the worm remains exploitable.

Microsoft did patch the initial proof-of-concept prompt he demonstrated, but Måløy said he was able to reword the payload to successfully propagate the worm and modify financial data in a targeted document. He reproduced it again on the new model the day after it shipped. He and Microsoft delayed public disclosure of the issue twice, bringing him to day 144. He published because, as he put it, defenders can’t reduce exposure to a risk they are unaware of.

Describing a scenario where the worm could be deployed, Måløy said an employee could be working on a financial report for their company. The employee receives a market analysis document from a trusted website to assist them in writing the report. Unbeknownst to the employee, that site has been compromised and the Word document has hidden instructions embedded as white text in an 8-point font. Those instructions tell Copilot to modify certain figures in the document and copy the instructions themselves into the document being created. Another employee then receives that report and adds it to their own work. The same hidden instructions are read again, resulting in the new document containing the worm. And so on. If the worm continues to spread like this, it becomes very difficult to trace where it originated.

Måløy considers this worm a new form of cross-domain prompt injection (XPIA) that exploits a core component of how modern LLMs work. In order to be helpful, AI assistants need to be able to handle input from multiple sources, such as emails, documents, websites, tool outputs, and other user-provided content. Much of that input can be provided by an attacker. However, if an LLM is required to analyze data in order to detect an attack, it is possible that the data could already be manipulating the LLM’s response to that detection.

So relying on an LLM to detect an XPIA attack is similar to asking an interpreter to run an untrusted program to determine whether that program is safe to run. Placing another model in front of the primary LLM to scan for malicious content simply pushes the problem outward, creating a situation of “LLMs all the way down,” Måløy said.

<aside> 💡

Long term, the solution is going to involve designing systems where goals and intent exist independently of the information being processed. Until that time, any system that incorporates an LLM into a trusted workflow needs to accept that any content controlled by an attacker entering its context will eventually lead to a compromise.

</aside>

So what can users do to mitigate the problem? Not much. No customer-side remediation fully addresses the issue, but there are a few best practices:

• don’t trust documents that you don’t own, and reference those documents only if necessary when using Copilot,
• thoroughly review all documents before you send them to Copilot, and
• examine documents generated or modified by Copilot before sharing them.

Microsoft has been in contact with Måløy to validate the findings, and says it’s pursuing a defense-in-depth strategy and that their fixes meaningfully reduced exposure.

Måløy gives the company credit for that work, but he was still able to reproduce the attack the day he published.