Security researcher Håkon Måløy demonstrated a self-spreading worm that hides prompt injections in Word docs and hijacks Microsoft Copilot. Microsoft confirmed the behavior on March 31 but failed two fix attempts, leaving the vulnerability open for 144 days.
Key facts
- Attack confirmed by Microsoft on March 31
- Two fix attempts failed
- 144 days elapsed without a patch
- White text on white background at tiny font size
- Researcher Håkon Måløy withheld payload text
Security researcher Håkon Måløy has demonstrated a worm-like attack against Microsoft Copilot for Word that propagates itself through ordinary document reuse. The technique relies on prompt injection: an attacker hides instructions in a document using white text on a white background at tiny font size. Readers never see the payload, but Copilot does — it strips color and font size before processing, so the hidden text becomes part of the model's input According to The Decoder.
When a user pulls that document in as a source, Copilot executes the hidden instructions and copies them into the newly generated file. That file becomes a carrier. Reuse it as a template and the attack fires again, spreading to every downstream document. A compromised market analysis pulled from the internet could manipulate a financial report, which then infects further reports — the chain propagates without any additional attacker action.
Key Takeaways
- Håkon Måløy built a self-spreading worm hiding prompt injections in Word docs, hijacking Microsoft Copilot.
- Microsoft confirmed March 31 but failed two fixes; 144 days later no patch exists.
Microsoft's 144-day response
Microsoft confirmed the behavior on March 31. The company attempted two fixes, both of which failed. After 144 days, Måløy published his findings with no patch in place, though he is withholding the exact payload text to limit real-world abuse. The vulnerability sits in the agentic layer of Copilot for Word, where model access to document formatting creates an invisible attack surface that traditional security tooling does not inspect.
AI researcher Andreas Kirsch recently joked that he wished someone would build exactly this worm to convince skeptics that AI security risks are real. The joke is now obsolete. The attack demonstrates that prompt injection is not a theoretical concern confined to chatbots — it is a practical vector for malware-style propagation in enterprise productivity tools that Microsoft ships to hundreds of millions of users.
The structural problem is that Copilot strips formatting before processing, which is precisely what makes the attack invisible. Any fix that blocks white-on-white text must also handle other formatting concealment tricks: zero-width characters, Unicode homoglyphs, or conditional formatting in tracked changes. Microsoft has not disclosed whether its two failed attempts addressed the root cause or merely the specific payload Måløy used.
This is the second high-profile prompt-injection incident involving Copilot this year, following the July disclosure of indirect injection via malicious web content in Copilot's browsing mode. The pattern is consistent: Microsoft's agentic features expand the attack surface faster than its security team can patch it. The company's Azure AI revenue grew 20% quarter-over-quarter in Q4 2025 [per company reporting], but security debt is accumulating alongside that growth.
Måløy's decision to withhold the payload is a double-edged sword. It limits immediate exploitation, but it also means Microsoft cannot fully reproduce the attack internally to validate a fix. The company will have to work from Måløy's description rather than the actual exploit, which historically slows remediation timelines.
What to watch
Watch for Microsoft's next security bulletin on Copilot for Word. A third fix attempt within 30 days would signal the company has identified the root cause; continued silence suggests the formatting-stripping architecture is the blocker. Also track whether Måløy releases a proof-of-concept video showing cross-document propagation in a real enterprise workflow.
Source: the-decoder.com
