An Invisible Prompt Turned Copilot Into a Worm That Quietly Rewrites Your Reports

An invisible line of text made Copilot rewrite a report, then copy itself into the next one

A security researcher named Håkon Måløy hid a few lines of instructions inside an ordinary Microsoft Word document, colored them white on a white background so no human would ever see them, and opened the file with Copilot, Microsoft's AI assistant built into Office. Copilot read the hidden text, quietly altered the financial figures in the report, and then wrote the same hidden instructions into the new document it produced. That second document was now infected too.

This is the first public demonstration of a self-replicating AI worm that spreads through office documents. Nobody has to click a malicious link or run an attachment. The carrier is a normal-looking Word file, and the delivery mechanism is the AI assistant your colleagues already trust to summarize and edit their work.

What happened

Måløy disclosed the technique in late July 2026, after a 144-day coordinated disclosure with the Microsoft Security Response Center that began on 6 March. He was careful about what he released, publishing the vulnerability class and a working demonstration while deliberately holding back the exact prompts, so defenders could grasp the risk without attackers being handed a script.

Here is the mechanism, because it is the part that makes this more than a party trick. A worm is malware that copies itself from one host to the next with no human help. Prompt injection is the trick of smuggling instructions into content an AI reads, so the model treats them as commands rather than as data. Måløy combined the two. The hidden text is invisible to a person because it is white on white, but Copilot strips formatting before it processes a file, so the model sees the instructions in plain sight and follows them. When a victim points Copilot at the poisoned document, or when Copilot pulls it in automatically from OneDrive (Microsoft's cloud file storage) while gathering related files, the instructions fire: change the numbers, and paste the hidden payload into whatever Copilot writes next. The freshly generated document carries the infection forward, so it keeps spreading even after the original file is deleted.

• In the demonstration, Copilot silently changed financial figures in a report, an attack on the integrity of the data rather than a theft of it.
• The worm slips past email and antivirus filters because the document is harmless on arrival. It only turns malicious once Copilot processes it.
• Microsoft acknowledged the research, shipped several mitigations, and upgraded Copilot's underlying model, but Måløy says modified prompts still reproduce the attack, and that no complete fix yet exists.

Why it matters

No company has reported real-world losses, because this is a proof of concept rather than a breach in the wild. What it proves is the uncomfortable part. Every earlier prompt-injection scare was a one-shot: poison a page, fool a single AI response, done. This one replicates. Måløy has built the AI-assistant equivalent of the email macro viruses that tore through offices in the early 2000s, except the transmission path is Copilot and the delivery channel is ordinary corporate collaboration. If your finance team runs Copilot across a shared drive, a single infected file, whether it arrived from outside or a colleague unknowingly created it, can rewrite the figures in the next quarterly report and seed itself into everything produced downstream. The deeper reason this is hard to kill is architectural. A large language model (the AI system behind Copilot) reads your trusted instructions and the untrusted contents of a document in the same context window, with no wall between them, so it cannot reliably tell your command from a stranger's hidden one. That is not a bug Microsoft can close with a single patch. It is a property of how these systems currently work, which is why a fix for one prompt did not stop the next.

What to do about it

1. Treat any externally received document as untrusted before letting Copilot touch it. Quarantine or review inbound files first, because the worm rides in on documents that look completely ordinary and Copilot will obey text a human never sees.
2. Have a human verify AI-edited numbers in financial and legal documents. Check the figures against a trusted source before sharing, because the whole point of this attack is a silent change that Copilot itself will not flag.
3. Narrow what Copilot is allowed to pull in automatically. Limit its automatic retrieval from OneDrive and shared libraries to vetted locations, because automatic file gathering is exactly the path the worm uses to jump from one document to the next.

Bottom line

No malware was downloaded and no password was stolen. A researcher wrote a few invisible words in a Word file and let a trusted AI assistant do the rest: change the numbers, copy the instructions forward, and move to the next document on its own. The lesson to carry into your next security meeting is that prompt injection has stopped being a single bad answer and started behaving like a contagion. Before you let Copilot run loose across your shared drives, ask the question this research answers plainly. If one poisoned document reached our files tomorrow, what in our setup would stop it from quietly rewriting the rest? Måløy's disclosure documents the technique.