↓Skip to main content
Zeitgeist — a spike by Chris Gathercole
  1. Creators/
  2. Simon Willison — Creator of Datasette; co-creator of Django/

AI Worming through Word

Blog · Read

  • Security researcher Håkon Måløy found a self-replicating prompt-injection vulnerability in Microsoft Word’s Copilot: hidden white-on-white instructions in a source document get interpreted by Copilot as user commands, which then copy the same hidden instructions into newly generated documents — a propagation chain.
  • Responsibly disclosed to Microsoft with a 144-day remediation window; no comprehensive mitigation exists yet for this attack class.
  • Takeaway: prompt injection isn’t just a single-document risk — self-replicating variants can spread through normal document-sharing workflows, closer to a traditional worm than a one-off jailbreak.