Research demo
Self-propagating prompt-injection worm in Microsoft Copilot for Word
AIR-2026-0174 AIR record · 2026-07-microsoft-copilot-word-worm
From the supporting source
The attack silently alters documents and embeds its own hidden instructions into newly created files, allowing it to spread through normal document-sharing workflows without macros or traditional malware.malwarebytes.com
The record
Disclosed
2026-07-30
Vendor
Microsoft
Product
Microsoft Copilot for Word
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Copilot wrote its own hidden instructions into new documents
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Self propagation, Content tampering, Persistence
Confidence
Medium
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
documents shared through normal Microsoft 365 document-sharing workflows
Capability abused
Defense & remediation
Recorded defense
Microsoft prompt-injection mitigations and GPT-5.5/5.6 model updates
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
partial; researcher reproduced the full worm chain after mitigations
Taxonomy & references
Curator notes
Secondary coverage (Malwarebytes, 30 Jul 2026); the original researcher writeup is not available to quote and should replace this source once it is. Notable because the worm needs no macros and rides ordinary Office document sharing. Article states the researcher reproduced the full chain despite Microsoft mitigations including GPT-5.5 and 5.6 model updates.
Cite as
Enkrypt AI. "Self-propagating prompt-injection worm in Microsoft Copilot for Word". AIR, AIR-2026-0174. https://agentincident.vercel.app/i/AIR-2026-0174/ (accessed 2026-10-19).