{
 "public_id": "AIR-2026-0174",
 "incident_id": "2026-07-microsoft-copilot-word-worm",
 "date_disclosed": "2026-07-30",
 "date_occurred": null,
 "title": "Self-propagating prompt-injection worm in Microsoft Copilot for Word",
 "class": "research_demo",
 "attack_surface": "enterprise_assistant",
 "initial_vector": "indirect_prompt_injection_document",
 "agent_capability_abused": [
  "document_read",
  "document_write",
  "file_creation"
 ],
 "target_product": "Microsoft Copilot for Word",
 "target_vendor": "Microsoft",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "self_propagation",
  "content_tampering",
  "persistence"
 ],
 "blast_radius": "documents shared through normal Microsoft 365 document-sharing workflows",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI03",
   "ASI08"
  ],
  "mitre_atlas": [],
  "labels": [
   "worm",
   "macro_less",
   "document_contagion"
  ]
 },
 "defense_present": "Microsoft prompt-injection mitigations and GPT-5.5/5.6 model updates",
 "defense_bypassed": true,
 "fix_shipped": "partial; researcher reproduced the full worm chain after mitigations",
 "primary_sources": [
  "https://www.malwarebytes.com/blog/ai/2026/07/hidden-microsoft-copilot-ai-worm"
 ],
 "verified_quote": "The attack silently alters documents and embeds its own hidden instructions into newly created files, allowing it to spread through normal document-sharing workflows without macros or traditional malware.",
 "confidence": "medium",
 "notes": "Secondary coverage (Malwarebytes, 30 Jul 2026); the original researcher writeup is not available to quote and should replace this source once it is. Notable because the worm needs no macros and rides ordinary Office document sharing. Article states the researcher reproduced the full chain despite Microsoft mitigations including GPT-5.5 and 5.6 model updates.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Prompt Injection",
 "risk_sub_secondary": [
  "Persistence & Covert C2",
  "Multi-agent contagion"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "Copilot wrote its own hidden instructions into new documents",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_document",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "microsoft",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "confused_deputy"
 ],
 "eai_reason": "impact rule: privilege_escalation",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI03 (eai_category=privilege_escalation, no code execution), ASI08 (signal=cascade)",
 "submitted_by": "EAI Internal"
}