AI Worming through Word
Hidden prompt instructions in a Word document can make Copilot copy the attack into new documents.
Håkon Måløy’s variant turns prompt injection in Copilot for Word into a self-replicating carrier. The malicious instructions are hidden in a source document, then interpreted during a Copilot-assisted workflow and copied into the output. That output can trigger the same behavior later, even without the attacker’s original file. Willison says Microsoft had 144 days after responsible disclosure, but there is still no mitigation for the full class of attack. Simon Willison's note
Håkon Måløy’s variant turns prompt injection in Copilot for Word into a self-replicating carrier. The malicious instructions are hidden in a source document, then interpreted during a Copilot-assisted workflow and copied into the output. That output can trigger the same behavior later, even without the attacker’s original file. Willison says Microsoft had 144 days after responsible disclosure, but there is still no mitigation for the full class of attack. Simon Willison's note
score 5