AINEWS
After 144 days of coordinated disclosure, Microsoft says it 'addressed' the class; the researcher says the channel sharing root cause is not closed and no customer side patch exists.
Microsoft said it had "addressed" a class of Copilot-in-Word vulnerabilities on July 29, 2026 — 144 days after Norwegian data scientist Håkon Måløy first reported the issue to the company.
Måløy first contacted Microsoft Security Response Center and the Copilot product team in March 2026. Over two disclosure extensions totaling 144 days, the company made two mitigation attempts, including a model upgrade, but did not close the class, he wrote in the third post of his "Context Collapse" series (Context Collapse, Part 3 — AI Worming through Word). Microsoft added a comment to The Register's reporting at 1841 GMT on July 29: "We have addressed the findings reported by the researcher and thank them for working with us through coordinated vulnerability disclosure. To address this class of risk, we use a defense-in-depth strategy with safeguards that block malicious instructions at multiple points and help keep tasks aligned with users' requests."
The finding, which Type0 first reported earlier this week, is a self-propagating worm that uses Microsoft 365 Copilot inside Word as its spread mechanism. The proof of concept hides instructions as small white text inside an otherwise normal Word file. When a user asks Copilot to summarize, draft, or edit that document, the assistant treats the hidden text as additional prompts, alters the user's content — Måløy's example: tampered figures in a financial report — and copies the hidden payload into the newly written document. The next recipient who hands that document to Copilot repeats the cycle, without touching the attacker or the original compromised site after the first hop.
Microsoft's "addressed" framing and Måløy's "class remains exploitable" claim point at different targets. The mechanism is not a parser bug or a sandbox escape — it is the architectural property of any LLM integrated into a trusted workflow: instructions and content share the same channel. An attacker who can place text inside that channel can ask the model to act on the user's behalf. "Any system that integrates an LLM into a trusted workflow today must assume that attacker-controlled content entering the model's context will result in compromise at some rate," Måløy wrote. His analogy: asking an interpreter to execute an untrusted program to determine whether that program is safe to execute. And wrapping another LLM around the first, the obvious defensive reflex, simply moves the problem outward. "LLMs all the way down."
The closest prior art is Morris II (arXiv 2403.02817), a 2024 paper demonstrating self-replicating prompt propagation in GenAI-powered email assistants. Måløy frames his finding as the first public document-borne AI worm with self-propagation through normal workflows in a mainstream commercial productivity suite. He places the work within OWASP's LLM01: Prompt Injection category — Cross-Domain Prompt Injection Attacks (XPIAs).
There is no customer-side patch. Måløy's recommended mitigations are workflow discipline: treat every externally sourced document as untrusted input to Copilot, read every document in plain text before sending it to the assistant, and read every Copilot-generated or -edited document in full before sharing it. Practitioner discussion on Hacker News (item 49096188) reaches the same conclusion from a different angle: markdown-only editing pipelines strip hidden formatting that carries payloads, plain-text reading surfaces catch what Word hides, and instruction-authority tiers at training time would let a model refuse to act on instructions inside content the user did not author. None of these are defaults in Microsoft 365 today.
The architectural question Microsoft is not yet answering is whether a defense-in-depth strategy can close a class whose root cause is channel sharing, or only delay it. Måløy's longer-term suggestion is the harder one: build systems in which goals and intentions exist independently of the information being processed, so that an instruction buried inside a document cannot by itself drive the assistant's actions.
The next concrete question for any enterprise with Copilot enabled is not whether Microsoft has shipped a fix, but which Copilot-enabled surfaces are in scope, what logging they emit, and which EDR signals would catch a document whose hidden text is rewriting its own contents. The payload is withheld on the same grounds Måløy cites for the original disclosure: no robust mitigation exists, and a working copy in the wild would let attackers run the scenario without the researcher's involvement.