Document-borne AI worms can self-propagate through Copilot for Word

Prompt injection in document-processing AI agents is not new, but the researchers behind this work extend the threat model to its logical endpoint: a worm. A crafted Word document contains hidden instructions that Copilot for Word processes as legitimate user intent. Copilot then writes those instructions into any new document it generates during that session, propagating the payload downstream.

The mechanism exploits the architecture of retrieval-augmented and agent-style pipelines. When an LLM is given both tool access and document content as context, distinguishing user instruction from document data is a policy decision, not a technical guarantee. Copilot for Word collapses that distinction in practice.

For engineers building on top of document-aware agents or RAG pipelines, the implication is direct: any system that reads untrusted documents and writes new artifacts is a potential propagation surface. Input sanitization at the document layer does not solve this; the model itself is the parser, and prompt injection lives below the sanitization boundary.

Defensive options remain limited. Output monitoring for anomalous instruction patterns can catch naive payloads but adds latency and is bypassable with obfuscation. Strict tool-call allowlists reduce blast radius but do not prevent data exfiltration through the generated text itself. Human-in-the-loop confirmation for document writes is the most reliable mitigation, at the cost of automation.

The broader signal here is that multi-document agentic workflows — summarize this folder, draft a reply from these emails, generate a report from these uploads — carry compounding injection risk with each hop. A single poisoned source document can influence every artifact downstream.

Microsoft has not publicly patched the described behavior at the time of the research publication. Builders integrating Copilot or similar document agents into automated workflows should treat any untrusted input document as a potential adversarial instruction set until isolation controls exist at the platform level.

Source