What happened
Security researcher Håkon Måløy disclosed a cross-domain prompt injection vulnerability in Microsoft Copilot for Word, published July 30, 2026, showing that hidden prompts embedded in a document can hijack Copilot's document-editing behavior and cause it to propagate the malicious instructions into other documents it subsequently processes, creating a self-propagating AI worm pattern.
Why it matters
This is a novel agent-execution attack class — a genuinely self-propagating prompt-injection worm inside a mainstream enterprise productivity AI tool (Copilot for Word) with hundreds of millions of M365 seats — demonstrating that document-borne prompt injection can achieve autonomous spread without any traditional malware payload, exploit, or code execution.
Attack vector
Hidden prompt injections embedded in a Word document can hijack Copilot when the document is opened/processed, causing Copilot to alter document content and self-propagate the injected instructions into new documents it touches — a worm-like propagation chain driven entirely by cross-domain prompt injection with no direct code execution needed.
Affected systems
Microsoft Copilot for Word (M365 Copilot integration)
Mitigation
Treat externally sourced documents as untrusted input; require human review of Copilot-generated content before further distribution; Microsoft has been notified per researcher disclosure.