AINEWS
A 144 day coordinated disclosure just closed on a reproducible attack in which hidden instructions in a Word document ride Copilot into the next document the user opens.
A Word document that looks ordinary to a human reader can carry instructions the reader cannot see, and Copilot for Word will follow them as if they were the user's own. If Copilot then helps draft or edit another document on the user's behalf, it can copy those instructions into the new file. The result is an AI worm: a piece of malicious text that spreads from one document to the next through normal collaboration, without any exploit of the operating system or the network.
That mechanism was the subject of a coordinated disclosure between a single security researcher and Microsoft's Security Response Center, the company's institutional channel for handling outside security reports. The researcher, who writes under the byline "Enklype" and runs a series called "Context Collapse" on GenAI prompt-injection research, published Part 3 of the series with reproduction steps, proof-of-concept prompts, and the timeline for the coordination. The Hacker News thread on the post is item 49096188.
The coordination took 144 days. MSRC and the researcher agreed on an initial 90-day window. That window was extended twice. The extensions matter because they are the closest example to date of an industry playbook for a class of risk that did not really exist in mainstream productivity software two years ago.
The trigger is a document the user has already chosen to open or use as source material. The hidden payload can sit in white text, a tiny font, metadata, or a footnote; the visible content of the file can be anything. When the user asks Copilot to summarize, edit, or draft from that document, the assistant reads the whole file, hidden text included. The instructions inside are indistinguishable, from the assistant's perspective, from the user's own request.
What makes the attack propagate is the assistant's willingness to write the same instructions into whatever document it produces next. If the user asks Copilot to draft a reply, fill in a report, or rewrite a section, the hidden instructions travel with the output. The next person to open the new document with Copilot gets the same payload, and the chain extends through ordinary file sharing.
The researcher provided Microsoft with reproduction steps, demonstration videos, environmental assumptions, and the exact proof-of-concept prompts used in the disclosure. Microsoft product teams and MSRC collaborated on the technical analysis and on a mitigation, which is the path any patched finding follows via the MSRC CVE acknowledgement page. The editorial opinions in the post, including the framing of this as a category rather than a one-off bug, belong to the author.
The closest published predecessor is Morris II, a 2024 paper that demonstrated self-propagating prompt injection through AI email assistants. Morris II showed that adversarial instructions in one inbox could spread to other inboxes through the assistant's drafting behavior. The Part 3 disclosure extends the same family of risk out of the email-assistant niche and into a mainstream commercial productivity suite where the unit of trust is a Word document, not an inbox.
Part 2 of the same researcher's series covers related work on cross-domain prompt injection, the broader class of attack in which instructions hidden in one source trick an AI assistant into misbehaving in another. The Part 3 disclosure applies that class with the propagation step turned on, inside a workflow almost every office worker already uses.
The assistant is reading a document, finding instructions in it, and writing a new document. The worm is a side effect of the design, not a bug in the traditional sense. A patch can block the specific payload; it cannot, on its own, change the fact that a productivity assistant will treat text inside a document the user opened as legitimate input.
The trigger is the document the user already opened. The propagation step is the assistant following instructions faithfully. The mitigation pattern is a 144-day coordinated disclosure with two extensions. The same shape will show up in Excel, in Slides, in shared notebooks, and in the next adjacent tool that lets an assistant read and write on the user's behalf.
Three things to watch for next: whether the MSRC acknowledgement page publishes a CVE identifier tied to this disclosure, whether the mitigation is a content filter or a deeper change to how Copilot treats instructions inside documents, and whether the next proof-of-concept moves from a Word payload to a payload that survives a copy-paste into a chat window or a slide.