1. Executive summary
A researcher has publicly disclosed a self-propagating prompt-injection worm affecting Microsoft Copilot for Word. Malicious instructions hidden in a document's content (e.g., small white text) are interpreted by Copilot as commands, enabling an attacker to alter generated output — including financial data — and copy the worm payload into any new document Copilot generates from the affected file. No CVE has been assigned and no CISA-KEV entry exists; verified reference data could not be resolved for this item. The vulnerability class remains unpatched after 144 days of coordination with Microsoft and two failed mitigation attempts. EMEA financial services clients using Copilot for Word face a direct risk of silent data manipulation in financial reporting and self-propagating document contamination across normal collaboration workflows.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. The vulnerability is an unpatched software design flaw in a commercial AI productivity tool with no available customer-side remediation; while it could result in data integrity impact, the trigger facts do not distinctively engage a specific article beyond what would apply to any security advisory.
3. Technical analysis & attack chain
Confirmed attack chain (single-sourced; verify before enforcement)
- Initial access via document supply. An attacker compromises a trusted external website or directly shares a Word document containing hidden malicious instructions. No access to the victim's Microsoft 365 tenant is required.
- Context ingestion. A user opens Copilot for Word and includes the malicious document as source material for a project (e.g., preparing a financial report).
- Prompt injection execution. Copilot processes the document content and interprets the hidden instructions as additional prompts, rather than treating them solely as data. The hidden instructions are inserted as small white text in the proof-of-concept.
- Payload execution — data manipulation. The worm instructs Copilot to alter figures in the document the user generates. The researcher demonstrated successful alteration of financial data in a target document.
- Self-propagation. The worm instructs Copilot to copy the malicious instructions into the newly created document. Any subsequent user who includes that output document as Copilot source material triggers the cycle again.
- Persistence and spread. The attack continues without further involvement from the compromised website or the original malicious document. Tracing the infection to its source becomes extremely difficult as the worm propagates through normal document workflows.
Technical specifics
- Affected product: Microsoft Copilot for Word (Microsoft 365).
- Injection vector: Hidden text within document content (small white text in the PoC) interpreted as LLM prompts.
- Vulnerability class: Cross-domain prompt injection (XPIA) exploiting LLM context processing — the model cannot distinguish between data and instructions in its context window.
- Demonstrated impact: Alteration of financial figures in generated reports; self-propagation into derivative documents.
- Failed mitigations: Microsoft mitigated the original PoC prompt but a reworded payload bypassed the fix. A model upgrade also failed to close the vulnerability class.
- Coordination timeline: Researcher engaged Microsoft in March 2026; 144 days elapsed; two disclosure delays agreed; public disclosure proceeded after the coordination period was exhausted.
- Specific prompt payload: Withheld by the researcher; only the vulnerability class is described.
Confidence caveat: All technical detail in this section is single-sourced, originating from the researcher's blog post as reported by The Register. No independent corroboration, vendor advisory, or CVE assignment is available at time of publication. Verify before enforcement.
4. Mitigation & containment
No customer-side remediation fully addresses the issue at time of publication. The following controls reduce but do not eliminate risk.
P1 — Within 24 hours
- Issue an internal advisory to all Copilot for Word users warning that externally sourced documents must be treated as untrusted when used as Copilot context material.
- Identify business units using Copilot for Word in financial reporting, regulatory reporting, or client-facing document generation; flag these as high-risk workflows.
P2 — Within 72 hours
- Implement a manual review control: any Copilot-generated or Copilot-edited document that incorporated external source material must be fully reviewed by a human before distribution. This applies to both the content output and a check for anomalous inserted text (e.g., small white text).
- Where feasible, restrict Copilot for Word usage in regulated financial reporting workflows until Microsoft provides a robust fix for the vulnerability class.
- Review externally sourced documents for hidden text before uploading to Copilot context (check for white-on-white text, zero-point fonts, or hidden formatting).
P3 — Within 7 days
- Engage Microsoft support to request a status update on the vulnerability class and any roadmap for architectural mitigation.
- Document this risk in your ICT risk register and AI usage risk assessments.
- Evaluate whether Copilot integration with external data sources can be disabled or restricted at the tenant level pending a fix.
- Monitor Microsoft security channels for advisory publication or patch release.
5. Indicators of compromise
No indicators of compromise available in the source material. The researcher withheld the specific prompt payload. No file hashes, domains, IPs, or atomic indicators were published.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Small white text or hidden formatting containing prompt-like instructions embedded in Word documents | Document inspection in Word (reveal formatting, search for white/zero-point text) | Medium — single-sourced from PoC description |
| Financial figures in Copilot-generated documents that differ from source data | Manual comparison of Copilot output against source document data | Medium — demonstrated in researcher PoC |
| Copilot-generated documents containing text not attributable to user prompts or source content | Diff review of Copilot output against expected content | Medium — inferred from worm propagation mechanism |
6. Detection
Insufficient indicators to author detection rules. The researcher withheld the specific prompt payload, and no distinctive strings, file names, registry keys, or command-line artefacts were published in the source material. Behavioural detection (manual document review) is the only available control at this time.
7. Sources
- The Register, "Word worm crawls into Copilot, spreads chaos," https://www.theregister.com/security/2026/07/29/word-worm-crawls-into-copilot-spreads-chaos/5280588, 2026-07-29
8. Adverse Trace position
This is a credible disclosure of a fundamental LLM architecture flaw — cross-domain prompt injection enabling self-propagating document worms — with no available patch and demonstrated capability to alter financial data. Severity is high for EMEA financial services clients using Copilot for Word in regulated workflows, though no CVSS score has been assigned and verified reference data could not be resolved for this item. Attribution is not in scope; this is a vulnerability class, not a threat actor campaign. The single-sourced nature of the disclosure (one researcher's blog post, uncorroborated by a vendor advisory or independent analysis) warrants a confidence caveat, but the technical mechanism is sound and consistent with known XPIA research. We will monitor for a Microsoft advisory, CVE assignment, or independent corroboration and will update clients if a patch or architectural mitigation becomes available. Clients should treat this as an active risk to document integrity in AI-assisted workflows and implement manual review controls immediately.
Published via PulseTrace — Adverse Trace threat intelligence.