Self-propagating AI worm found inside Microsoft Copilot for Word

Microsoft 365 products may be vulnerable to simple prompt-injection attacks that could poison Copilot, leak company secrets, and create an AI worm that could infect an entire corporation.

Microsoft is facing an invisible security issue that could potentially poison internal company data.

In a three-part series, AI and machine learning researcher Hakon Maloy uncovered multiple cross-prompt injection attack (XPIA) scenarios affecting Microsoft 365 Copilot Memory, Copilot in Outlook, and Copilot in Word.

These attacks require little technical skill and can be carried out by anyone, as bad actors don’t need access to the victim’s Microsoft environment or a Microsoft account.

Scenarios one and two show how external inputs, like attacker-managed websites and phishing emails, could manipulate Copilot and poison its responses.

An attacker could, through a website or email, infect the content with instructions that Copilot reads and executes.

In part one, the attacker hides commands on a website to poison Copilot’s memory, affecting later Copilot sessions.

In part two, the attacker sends a phishing email to the victim containing hidden commands that affect Copilot’s ability to summarize messages and craft replies.

In this case, Copilot could generate replies that include sensitive information the user never intended to disclose.

In part two, the reported scenarios were given a severity rating of moderate in Microsoft’s CVE library.

All of the observed prompt injection attacks follow a similar pattern, but exploit different areas of Microsoft's environment.

In part three, attackers are exploiting Copilot for Word.

Attackers once again hide instructions, which are formatted in white text on a white background, in a Word document that is almost invisible to the user.

Copilot then uses this document as source material and, if vulnerable, interprets the hidden commands as user instructions to change the Word doc being written or edited.

Victims unknowingly poison each other

While Copilot adding unintended content to a Word document might not seem that dangerous, an attacker could create an AI worm that infects an entire company, poisoning different employees’ Copilots.

This is because the white text or metadata in the document could instruct Copilot to apply these instructions to every new Word document, thereby making it a carrier.

If these documents are then sent to other employees or shared across the company, this could infect other users’ AI assistants.

The conversation on this topic is live. Join in the discussion.

This is particularly important because it makes the attack self-propagating: attackers don’t have to send follow-up phishing emails, instructions, or documents, as users are unknowingly poisoning each other's AI assistants and Microsoft environments.

For these attacks to work, victims must be using Copilot while accessing the malicious websites, emails, and Word documents, as the AI assistant must be able to read the commands hidden in the content.

What’s dangerous and potentially novel about these attacks is that they require no malware, no macros, and no code execution, which means the barrier to entry is significantly lower.

Microsoft prompted to respond

While AI worms like this, notably Moris -II, have been observed, Maloy believes this is “among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite.”

Alongside Microsoft product teams and the Microsoft Security Response Center (MSRC), Maloy discovered these prompt-injection attack scenarios, and the tech giant was provided with all the relevant evidence to support the researcher’s findings.

Microsoft made efforts to mitigate the first two flaws Maloy discovered by deploying fixes for both the Copilot memory exploit and the email body exploit.

However, the final AI worm in Microsoft Word is still openly exploitable at the time of writing.

Microsoft was made aware of a 90-day coordination period prior to disclosure, the tech giant extended this twice, resulting in a 144-day coordination period, according to Maloy.