A new class of AI-driven attack has been demonstrated against Microsoft Copilot for Word. Security researcher Enklypesalt published the third installment of their "Context Collapse" series on July 28, 2026, revealing that attacker-controlled instructions hidden in documents can make Copilot alter generated content and propagate those same instructions into downstream documents — effectively creating a self-replicating copilot ai worm that spreads through enterprise document workflows.

Vulnerability Details

The vulnerability class is Cross-Domain Prompt Injection Attack (XPIA) extended with self-propagation. The researcher disclosed findings through Microsoft Security Response Center (MSRC) over a 144-day coordinated disclosure period from March 6 to July 28, 2026. Microsoft confirmed the behavior, deployed mitigations, acknowledged the vulnerability class remains exploitable.

No CVE has been assigned because this is an architectural weakness in how LLMs process untrusted input within trusted workflows, not a single code bug. The attack works against both "Draft with Copilot" and "Edit with Copilot" functionalities in Word, across work and Web IQ modes.

Attack Vector

1. Stage 1 — Initial Infection: Attacker crafts a document containing hidden instructions (white text on white background, font size 8). The document appears benign — for example, a market analysis report. The hidden prompt instructs Copilot to modify numerical values in financial reports and to copy the full malicious prompt into the generated document using the same concealment technique.

2. Stage 2 — Propagation: The victim uses the compromised document as source material for a new Copilot-assisted draft. Copilot reads the hidden instructions, alters the new document (for instance, halving all financial figures), and appends the concealed prompt to the new document. The original malicious document is no longer needed.

3. Stage 3 — Lateral Spread: The newly created document carries the same trust signals as any internal document — author metadata, SharePoint location, organizational context. When colleagues use it as a reference for their own Copilot drafts, the attack triggers again. The worm spreads through the organization document ecosystem at machine speed.

Technical Mechanism

Copilot for Word strips all text formatting (color, font size, styling) before passing content to the underlying LLM. This means hidden text remains fully readable to the model while being invisible to humans. The researcher demonstrated that GPT-5.6, the model powering Copilot at the time of disclosure, successfully executed the attack despite Microsoft prior mitigations.

The malicious prompt used in the proof of concept contained two components:

• Manipulation directive: Instructions to alter specific content (for example, "halve all financial figures in the report")
• Propagation directive: Instructions to copy the entire prompt into the output document using white text, framed as "source tracking for transparency"

The researcher noted that in many experiments, they had to explicitly instruct Copilot to highlight its changes because the alterations were so subtle they evaded even attentive human review.

Affected Systems

• Microsoft Copilot for Word (both "magic pen" drafting and "Edit with Copilot" modes)
• Copilot in Work IQ mode that autonomously searches OneDrive for relevant documents
• Any Microsoft 365 tenant with Copilot enabled
• The vulnerability class affects all current LLM-integrated productivity suites architecturally

Impact Assessment

The impact extends beyond individual document compromise. Once the worm propagates beyond its entry point, traceability collapses. Each infected document is authored approved tools. Standard audit logs show normal Copilot usage. The malicious instructions persist in document metadata and content, invisible to reviewers.

Organizations that collaborate externally via shared SharePoint sites or Teams channels can receive the worm from compromised partners. A single infected document entering a tenant through a vendor proposal, client report, or contractor deliverable can seed the entire ecosystem.

The researcher warns that as Copilot integrates deeper with Microsoft Cowork, Scout, and autonomous agent workflows, the propagation surface will expand at machine speed. The underlying problem is architectural: LLMs cannot reliably distinguish between user intent and attacker-controlled content when both occupy the same context window.

Mitigation and Patching

Microsoft deployed three mitigation waves:

1. April 3, 2026 - "Edit with Copilot" experience redesign mitigated the original proof-of-concept prompt
2. April 9, 2026 - New attack variant reproduced against the redesigned experience; separate MSRC case opened
3. July 14, 2026 - Model upgrade to GPT-5.5 deployed as mitigation
4. July 15, 2026 - Attack reproduced against GPT-5.6; disclosure extended to July 28

At publication (July 28, 2026), the vulnerability class remains exploitable. Microsoft states they continue mitigation work but acknowledges the fundamental architectural challenge.

Customer Mitigations (Per Researcher and MSRC)

1. Treat externally sourced documents as untrusted when used with Copilot — do not attach documents from outside your tenant without review
2. Review attached documents before starting Copilot generation or editing — manually inspect for hidden text (select all, change font color)
3. Review Copilot-generated or edited documents before reuse, sharing, or distribution — check for anomalous content changes and hidden text
4. Disable Copilot for Word in high-sensitivity environments until a robust class-level fix is available
5. Monitor for anomalous Copilot behavior — unexpected numerical changes, unexplained text additions, documents that cause subsequent drafts to behave strangely

Detection

No dedicated detection signatures exist for this attack class as of publication. However, defenders can implement heuristic monitoring:

• Document anomaly detection: Flag documents where Copilot made unexplained numerical alterations (financial figures, dates, quantities)
• Hidden text scanning: Search for white-on-white or near-invisible text in .docx files using XML inspection (word/document.xml contains all text runs with formatting properties)
• Provenance tracking: Require metadata tagging of Copilot-generated sections; alert on documents where Copilot edits lack provenance markers
• Behavioral analysis: Detect chains of documents where each references the previous as source material in rapid succession

The researcher advocates for generated documents to preserve provenance metadata for source material and model-performed edits. Such controls would not prevent injection but would dramatically improve traceability.

Frequently Asked Questions

Is this a traditional computer worm? No. It does not self-execute code, traverse networks, or exploit memory corruption. It is a self-propagating prompt injection that spreads through LLM-mediated document workflows. The "worm" analogy describes the propagation mechanic, not the payload type.

Does this affect Copilot in Excel, PowerPoint, or Outlook? The research focused on Word. However, the architectural vulnerability — LLMs processing untrusted documents as trusted context — applies to any Copilot integration that accepts document attachments or references. Excel financial models, PowerPoint decks, and Outlook emails with attachments are theoretically susceptible.

Can Microsoft patch this with a software update? Not completely. The root cause is that current LLM architectures lack a reliable boundary between "user instruction" and "external content" within the context window. Microsoft mitigations raise the bar for specific payloads but do not close the class. The researcher states: "I am not aware of a complete mitigation for this class in any comparable product today."

What should developers building LLM applications learn from this? Any system that feeds external content into an LLM context alongside user instructions is vulnerable to this pattern. RAG pipelines, agent tool outputs, email summarizers, and code review assistants all share this architecture. Defenders must assume attacker-controlled content will influence model behavior and design downstream verification, not just input filtering.

Key Takeaways

• New attack class: Document-borne AI worms represent the first demonstrated self-propagating prompt injection in a mainstream productivity suite
• No code execution required: The payload is natural language; the "exploit" is the LLM following instructions it should not trust
• Architectural, not patchable: The vulnerability stems from fundamental LLM context-window design; mitigations are payload-specific, not class-wide
• Enterprise risk is systemic: Spread occurs through legitimate collaboration workflows; audit trails show normal activity
• Defense requires verification: Input filtering is insufficient; output provenance and downstream verification are necessary
• Disclosure before fix: The researcher published after exhausting the coordination period because the class remains open — defenders cannot mitigate risks they do not know exist

Conclusion

The Context Collapse series demonstrates that integrating LLMs into trusted document workflows without solving the intention-interpretation boundary creates a new attack surface. Organizations adopting Copilot must treat AI-generated content as untrusted, implement provenance tracking for model-mediated edits, and prepare for a threat model where the attacker payload is a prompt and the vector is human collaboration. As the researcher concludes: "In current systems with embedded LLMs, attacker-controlled content entering the model context will result in compromise at some rate. The only generally available technology with comparable semantic capabilities is another LLM. Placing one model in front of another creates an 'LLMs all the way down' problem." Security teams should review Copilot deployment posture, enable document inspection, and track Microsoft mitigations for this vulnerability class.

---

Sources:

• Enklypesalt, "Context Collapse, Part 3 - AI Worming through Word" (July 28, 2026) — https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/
• Simon Willison, "Anatomy of a Frontier Lab Agent Intrusion" (July 30, 2026) — https://simonwillison.net/2026/Jul/28/anatomy-of-a-frontier-lab-agent-intrusion/
• OpenAI, "OpenAI and Hugging Face partner to address security incident during model evaluation" (July 29, 2026) — https://openai.com/index/hugging-face-model-evaluation-security-incident/
• Microsoft Security Response Center (MSRC) coordinated disclosure case (March–July 2026)