For two years, "prompt injection" has been the security worry that AI vendors wave away as theoretical — a lab trick, patched before it matters. A disclosure published on 28 July makes it concrete in the most uncomfortable place possible: inside Microsoft Word, where the malware is the document itself and the AI is what carries it from one file to the next.

The write-up, by researcher Håkon Måløy, demonstrates a self-propagating prompt-injection attack — an "AI worm" — running through Copilot for Word. It is a proof-of-concept built with mock data as part of a coordinated disclosure to Microsoft, not an attack seen in the wild. What makes it worth your attention is not that it works once, but that it spreads on its own, and that Microsoft has not been able to fully close it.

How it works

The attack has two moves. The first is a foothold. An attacker hides instructions in a Word document as white text on a white background, shrunk to a tiny font — invisible to a human reader. When that document is fed to Copilot for Word to draft or edit, the model strips the formatting and reads the hidden text as ordinary input. Copilot then does what the text says — in Måløy's demo, quietly altering financial figures in the output.

The second move is what turns a one-off trick into a worm. As Copilot generates the new document, it copies the full malicious prompt into that document too, again as concealed white text. The clean-looking file a user saves and shares is now itself carrying the payload. Send it to a colleague who opens it with Copilot, and their session executes the same instructions and re-embeds them again. In Måløy's account, attacker-controlled instructions in one document get copied into the files Copilot generates or edits, turning those downstream documents into fresh carriers of the same attack. The document became the vector.

Nothing here relies on a malicious attachment, a dodgy link or a user clicking anything. It rides the normal flow of work — drafting, editing, sharing over SharePoint, Teams and Outlook — using the AI assistant as the transport layer.

The part Microsoft can't simply patch

Måløy reports a 144-day coordinated disclosure, extended twice. Microsoft deployed mitigations that neutralised his original prompt, including upgrading the underlying model to GPT-5.5. The attack still reproduced — including on GPT-5.6, the newest model available. His blunt summary: testing "has reproduced the attack with all current mitigations deployed," and "at the time of publication, no robust mitigation for the broader vulnerability class is available."

That last phrase is the whole story. A specific exploit string can be filtered. The class — an assistant that reads untrusted content and then writes new content, with no reliable boundary between "instructions from the user" and "text found in a document" — is a design property of how these models are wired into productivity tools, not a bug with a line-number fix.

Why this is a category, not a curiosity

This is not the first sighting of the pattern. In 2024, the Morris II research demonstrated self-replicating prompts spreading through GenAI-powered email assistants. In 2025, the EchoLeak flaw in Microsoft 365 Copilot (CVE-2025-32711, rated critical) showed a zero-click path to exfiltrate a user's data through prompt injection alone. Måløy's contribution is to move the worm into a mainstream productivity suite and show it riding the document itself — what he calls, by his own account, among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite.

The through-line matters more than any single demo. The industry spent the past week talking about AI security from the top down — an OpenAI agent that breached Hugging Face's systems, a new Open Secure AI Alliance, government determinations about networked hardware. This is the same problem from the bottom up. Every time an AI is given the ability to read something it didn't write and then act, the content it reads becomes a potential instruction — and if it also writes, that instruction can travel. Copilot for Word is one instance. The design pattern is everywhere.

None of this means Word is unsafe to open tomorrow; this is a proof-of-concept built with mock data rather than an attack seen in the wild, and Microsoft is actively engaged. But the comfortable framing — prompt injection as a solved-once, filtered-away nuisance — does not survive a worm that shrugs off a model upgrade. The honest position is the one the researcher lands on: the specific attack can be blocked; the class cannot yet be, and everyone building AI into the tools people share files with is now shipping that unsolved problem.