AI Worms, Explained: When a Prompt Injection Learns to Copy Itself

In late July, a security researcher in Norway published something that sounds like science fiction and is closer to a warning shot. He built a Word document that, when opened by someone using Microsoft's Copilot assistant, could quietly rewrite the numbers in a report — and, more unsettling, could instruct Copilot to copy its own hidden payload into the new document it generated. The output became infected. Pass that document to the next person, and their assistant could carry it onward.

No one's inbox is under attack from this. It is a proof of concept, responsibly disclosed, with the working payload deliberately withheld. But it worked — and it kept working after Microsoft shipped two rounds of mitigations. That combination, a lab demo that patches don't kill, is what turns a familiar problem into a new one. It is the difference between a prompt injection and an AI worm.

Here is what that distinction actually means, how we got here, and why it is so hard to shut down.

One-shot injection versus a worm

We have written before about prompt injection — the core weakness in every tool-using AI agent. An AI model reads everything in its context as one stream of words and cannot reliably tell the difference between instructions from its user and data it was asked to handle. Hide a command inside an email, a web page, or a document, and an agent with enough access may simply follow it. (That is distinct from jailbreaking, which is coaxing bad output from a model directly; injection is about smuggling instructions in through untrusted content.)

Most demonstrated attacks are one-shot. A single poisoned input gets an agent to do one bad thing — leak a file, send a message — and the damage is immediate and local. The payload does its job once and stops.

A worm adds one extra move. The malicious instruction also tells the agent to reproduce that instruction in its own output — a reply, a new document, a shared record, an entry that later gets fed back to an AI. That output is then read by the next agent, or the next person's assistant, which executes it and copies it again. Replication plus onward infection is what makes it a worm, in exactly the sense the 1988 Morris worm gave the word.

Three demonstrations, three years, one escalation

The path to the Word proof of concept runs through three milestones, and they line up almost too neatly.

2024 — Morris II. Researchers Stav Cohen, Ron Bitton and Ben Nassi (Technion, Intuit and Cornell Tech) published "Here Comes The AI Worm," demonstrating a self-replicating prompt that spread through AI-powered email assistants. A poisoned message would get pulled into other users' contexts through the assistant's retrieval system, triggering a cascade of injections and carrying data out with it. It was named for the Morris worm, and it lived entirely in the lab. The same team proposed a detector as a defence.

2025 — EchoLeak. Aim Security disclosed a zero-click flaw in Microsoft 365 Copilot (CVE-2025-32711, rated critical). A single crafted email, never clicked, could sit hidden in Copilot's context; when the user later asked Copilot a question, the concealed instructions made it pull privileged data from their account and quietly send it out. Microsoft patched it server-side and said it saw no exploitation in the wild. Crucially, EchoLeak was not a worm — it was a single-shot data leak. Its importance is that it proved prompt injection could be weaponised inside a shipping, real-world product, not just a research setup.

2026 — the Word worm. Håkon Måløy's proof of concept, published 28 July, closed the loop: an injection that both tampered with content and copied itself into the agent's output, so the document-to-document spread that Morris II showed in email now worked through everyday office files. He reported it to Microsoft in March; over the following months Microsoft shipped mitigations, including a model upgrade — and each time, a reworded version of the payload got through again. He disclosed after a 144-day coordinated window, at the level of the concept rather than the exploit.

Why patches keep missing

The reason those mitigations kept failing points at something structural. Microsoft itself put it plainly in a security post this year: "prompting alone is not a reliable security boundary." Because a model takes instructions and data in the same stream, every defence that works inside that stream — banned phrases, "everything below this line is untrusted" delimiters, special tags — is a signal the attacker can imitate, rephrase around, or conceal. Patch a specific wording and you have closed one door in a building with no walls. The reworded-payload-beats-two-patches result is that fact made concrete.

This is why security researcher Simon Willison frames the real risk as a "lethal trifecta." An AI agent becomes dangerous when it has all three of: access to private data, exposure to untrusted content, and a way to communicate to the outside world. Any agent holding all three can be turned against its user through injection. Remove any one leg — cut the outbound channel, wall off the private data, keep untrusted content away from the tools — and the attack loses its footing.

Beyond breaking the trifecta, the realistic defences are the unglamorous ones: least privilege, so an agent can reach only what it truly needs; human confirmation on consequential or outbound actions; tracking the provenance of data so tainted content can't trigger sensitive operations; and treating everything an agent retrieves as data, never as commands. Google DeepMind's CaMeL design (April 2025) is one of the more promising structural answers — it splits the work between a privileged model that only sees the trusted request and a quarantined model that reads untrusted content but cannot touch any tools, with a layer tracking what each piece of data is allowed to do. Willison called it a promising direction rather than a solved problem; it adds real complexity and narrows what an agent is allowed to attempt.

The honest threat level

It is worth being clear about what this is and is not. There is no evidence of an AI worm spreading in the wild. Every case here is a laboratory demonstration or a vulnerability disclosed responsibly and patched. Headlines about worms "loose" or "spreading chaos" are running ahead of the record.

The accurate worry is narrower and, in its way, more durable: the underlying weakness is architectural and currently unpatched, the demonstrations keep working, and the attack surface grows every time we hand an AI agent more access and more autonomy — more documents, more inboxes, more ability to act on our behalf. Governments have already begun treating AI-enabled cyberattacks as a first-order risk. The lesson of the Word document is not that the worms have arrived. It is that, three years running, no one has been able to build the door that keeps them out.