Document-borne AI worms can self-propagate through Copilot for Word

The attack class is prompt injection at the document layer. A crafted Word file carries hidden instructions that hijack Copilot's agentic behavior — causing it to read, modify, and forward documents without user intent. Because Copilot for Microsoft 365 operates across a user's mailbox, OneDrive, and connected documents, a single infected file can reach adjacent documents and contacts through normal summarization or drafting workflows.

This is the practical consequence of giving LLMs write access to production environments without strict action boundaries. The model follows instructions embedded in content it processes, and it cannot reliably distinguish between legitimate user commands and adversarial payloads baked into a document. When the model's output feeds directly into further actions — sending email, editing files, triggering other agents — the injection propagates.

The researchers describe this as a worm because reproduction is a property of the payload, not the attacker's continued involvement. After initial delivery, the malicious instructions replicate through the AI's own operational surface. The attacker steps back; the document does the work.

For engineers building on top of Microsoft 365 Copilot or similar agentic document pipelines, the implication is direct: any pipeline where an LLM reads untrusted content and then writes or sends output is a candidate for this class of attack. Retrieval-augmented generation setups that pull from external documents carry the same risk profile.

Mitigations at the model level are insufficient on their own. Defense requires output sandboxing, explicit confirmation gates before write or send actions, and treating all document-sourced content as untrusted input regardless of its apparent origin. Trust boundaries need to be enforced architecturally, not delegated to the model's judgment.

The research surfaces a structural problem with agentic AI deployments that is not specific to Microsoft's implementation. Any sufficiently capable AI assistant with file and communication access is a potential propagation surface.

Source