Risk Alert
Prompt Injection Finds a Self-Replication Path in Word
A researcher describes a Copilot for Word prompt-injection variant in which hidden document instructions may enable worm-like replication.
Simon Willison highlighted a prompt-injection technique found by Håkon Måløy. An attacker places hidden instructions in a document that is later supplied as source material to Copilot for Word, which may interpret the embedded content as part of the user’s request. The variant is described as turning prompt injection into a self-replicating, worm-like attack.
Documents Become Both Data and Instructions
The technique exploits the dual role of an office document. To a person, it is content to be read or edited; to a generative-AI feature, it may also become model context. According to Willison’s account, hidden instructions placed by an attacker could be processed by Copilot for Word without a reliable distinction between untrusted document content and the user’s actual directions.
The Risk Moves Beyond a Single Injection
The notable claim is not merely that one request can be redirected, but that the technique can become self-replicating. If injected instructions influence documents produced or processed later in a workflow, the malicious content could continue to propagate. The supplied material does not specify reproduction steps, success rates, affected versions, or the breadth of propagation, so widespread practical exposure cannot yet be inferred.
Independent Validation Is Still Needed
The current evidence is Willison’s description of Måløy’s work, without a second independent source. The cautious conclusion is that the case identifies an exploitable boundary between document content and operational instructions—not that every Copilot for Word environment is vulnerable. Product mitigations, default permissions, and the ability to write generated output into new documents would all affect whether replication can persist.
What to watch next
The next verifiable steps are a full technical disclosure or reproducible demonstration from Måløy, confirmation from Microsoft of affected conditions and versions, and documented mitigations. Independent testing in controlled environments should establish whether the replication chain works reliably and whether the issue is primarily conceptual or operational.