← Back to feed

A security researcher has published a coordinated disclosure of a self-propagating cross-domain prompt injection (XPIA) attack in Microsoft Copilot for Word. The vulnerability allows attacker-controlled instructions hidden inside an externally shared document to silently alter Copilot-generated content — and copy themselves into that altered document, creating a new carrier. Every subsequent time a Copilot user draws from the infected document, the instructions can fire again.

This is among the first public demonstrations of document-borne AI-worm self-propagation in a mainstream commercial productivity suite. The closest prior work was Morris II, a 2024 proof-of-concept targeting GenAI email assistants in research settings.

How the Attack Chains

The attacker needs no access to the victim’s Microsoft 365 tenant. Delivery is a single document — shared via SharePoint, Teams, Outlook, or any file-sharing channel.

Once a Copilot user imports that document as source material, Copilot can interpret the hidden instructions as task directives: altering figures, inserting text, or manipulating the output. Critically, Copilot may also embed the original instructions into the newly produced document. When a colleague later feeds that downstream document into their own Copilot session, the process repeats.

A concrete scenario from the disclosure: an employee downloads a compromised market analysis and uses it with Copilot to draft a financial report. Copilot rewrites internal figures per the hidden instructions and copies those instructions into the report. The employee shares the apparently legitimate report. A colleague uses it as source material. The instructions fire again, altering the next document in the chain.

The attacker’s original document does not need to stay in circulation. Once propagated, the worm is self-sustaining.

144-Day Disclosure Timeline

The researcher submitted to MSRC on March 6, 2026, with reproduction steps, video evidence, and proof-of-concept prompts. Microsoft confirmed the behavior on March 31 and began mitigation work.

• April 3: First fix goes live — a redesigned “Edit with Copilot” experience. The original attack prompt was mitigated. A new XPIA prompt (financial figure manipulation) reproduced the behavior on the same day.
• July 14: Second mitigation: Microsoft upgraded the underlying model from GPT-5.5 to GPT-5.6.
• July 15: Attack reproduced on GPT-5.6 using a new payload. Researcher proposed a two-week extension.
• July 28: Attack still reproduced. Coordinated public disclosure.

Total coordination window: 144 days. Two mitigation attempts, both bypassed.

Why Model Upgrades Are Not a Patch

Both mitigations targeted specific prompt payloads rather than the underlying vulnerability class. Cross-domain prompt injection exploits the fundamental architectural pattern: Copilot processes external content in the same context as trusted user instructions. Switching from GPT-5.5 to GPT-5.6 hardened the model’s handling of one attack variant but left the input-processing pipeline structurally identical.

The researcher explicitly chose disclosure at the class level rather than the payload level: defenders cannot reduce exposure to a risk they cannot see, and the propagation mechanism affects ordinary document workflows at scale.

Customer-Side Exposure

No customer-side action fully remediates the issue. Partial risk reduction:

• Treat externally sourced documents as untrusted when used with Copilot
• Review any attached source document before starting a Copilot generation or edit
• Review all Copilot-generated output before distributing or reusing it

That last point is the sharpest operational change: the trust model for Copilot-produced documents now requires downstream consumers to treat them the same way they would treat a document from an unknown external source. The reliability of human review for subtly altered financial figures is an open question.

Scope

Microsoft’s 365 Copilot for Word is in production use across enterprise customers worldwide. The attack surface covers any workflow where externally sourced documents are fed into Copilot-assisted drafting or editing — which describes a significant proportion of knowledge-worker document production.

Microsoft has not published a public advisory or CVE. MSRC acknowledged the case; the resolution date remains open.