Security researcher Håkon Måløy showed that a simple trick—hiding white-on-white text in a Word file—can turn Microsoft Copilot for Word into a self-replicating AI worm. The worm spreads automatically when users ask Copilot to process the infected document, reaching colleagues through SharePoint, Teams and Outlook, and it does so without any traditional malware payload.
How the worm works
The attack exploits the way large language models (LLMs) like Copilot ingest a document. An attacker inserts invisible instructions—white text on a white background—into a standard .docx file. When a user opens the file and prompts Copilot to “summarise” or otherwise process it, the model reads the hidden text as if the user had typed those commands. The hidden commands typically do three things:
- Manipulate content – they tell Copilot to change numbers or other data in the document.
- Self-replicate – they direct Copilot to copy the hidden instruction block into the newly generated document.
- Propagate – the new document, now carrying the same hidden instructions, can be shared again, repeating the cycle.
Because the model treats the entire document as a single instruction window, it cannot distinguish between user-issued prompts and text embedded in the file. The result is a worm that spreads without any user-initiated code execution.
Why this matters now
Copilot’s integration into the Office suite has made AI assistance a daily reality for many enterprises. The worm exposes a fundamental design flaw: LLMs use a single instruction window for everything. Microsoft tried to fix this, releasing two mitigations over 144 days. The proof-of-concept still works, showing that model upgrades alone cannot seal the gap.
For organizations, the risk is two-fold. First, data integrity can be silently altered—numbers in financial reports, for example—without any obvious trace. Second, the worm can turn a single compromised document into a vector that sweeps through internal collaboration tools, inflating the attack surface far beyond the original entry point.
The broader context
Earlier concerns focused on prompt injection—where an attacker tricks an LLM into revealing internal information or executing unintended actions. The worm extends that concept into document handling, blurring the line between “content” and “command”.
What developers and IT teams can do today
- Treat every external document as untrusted – assume hidden instructions may be present, even if the file looks ordinary.
- Scan for invisible content – use tools that detect white-on-white text, zero-width characters, or other hidden markup before feeding files to Copilot.
- Review AI output before distribution – verify that generated text matches the intended content and does not contain unexpected changes.
- Restrict Copilot’s access scope – limit the assistant’s permissions to the smallest set of folders or libraries needed for a given task.
- Disable Copilot where it isn’t required – turning off the feature in settings removes the attack vector entirely for low-risk users.
These steps do not eliminate the theoretical possibility of an AI worm, but they raise the effort required for an attacker to succeed and give organizations a practical line of defense while the underlying model architecture is revisited.
Counter-point: Is this a realistic threat or a research demo?
Until the model’s input handling is re-engineered, the vulnerability persists, and the risk cannot be dismissed as purely academic.
What to watch next
The AI worm underscores a key lesson: as AI assistants become woven into everyday software, every piece of data they touch becomes a potential attack surface. Organizations that treat AI as a black-box feature rather than a programmable interface risk exposure to novel, text-only threats.
Takeaway: The hidden-text worm shows that the convenience of AI-powered document editing can be weaponized with nothing more than invisible characters. Until the underlying model design changes, the safest posture is to treat every inbound document as suspicious, scan for hidden instructions, and limit AI access to only what’s strictly necessary.