--- title: Microsoft patched the Copilot Word worm twice. It still... description: A Norwegian security researcher has discovered a self-propagating prompt injection worm targeting Microsoft Copilot in Word documents. The attack hides... canonical: https://daily.dev/posts/microsoft-patched-the-copilot-word-worm-twice-it-still-works--e4c5y8css twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft patched the Copilot Word worm twice. It still works. | daily.dev og:description: A Norwegian security researcher has discovered a self-propagating prompt injection worm targeting Microsoft Copilot in Word documents. The attack hides... og:url: https://daily.dev/posts/microsoft-patched-the-copilot-word-worm-twice-it-still-works--e4c5y8css og:image: https://api.daily.dev/og/posts/e4C5y8CSs.png og:image:alt: Microsoft patched the Copilot Word worm twice. It still works. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft patched the Copilot Word worm twice. It still works. **[Trends](https://daily.dev/sources/trends)** · 2 min read · 1 upvotes · 0 comments ## Summary A Norwegian security researcher has discovered a self-propagating prompt injection worm targeting Microsoft Copilot in Word documents. The attack hides malicious instructions in white-on-white text that Copilot reads and executes — altering financial data, rewriting content, and copying the payload into output files to infect the next user. Microsoft confirmed the issue in March and shipped two fixes, including a GPT-5.5 upgrade, but the researcher rewrote the payload and it worked on GPT-5.6 the next day. The core argument is architectural: any system where a model must process untrusted input to judge whether it's malicious is fundamentally broken, because reading the content is the attack. With 30 million paid Copilot seats and aggressive enterprise expansion, the stakes of an unresolved self-propagating document worm are significant. After 144 days and two failed patches, the exploit remains live. ## Content A Norwegian researcher disclosed an AI worm targeting Microsoft Copilot back in March. Microsoft confirmed it, shipped two fixes, upgraded the underlying model to GPT-5.5, and called it handled. The researcher rewrote the payload. It worked on GPT-5.6 the next day. That's the whole story, really. ## How it works The attack hides prompt injection instructions in Word documents using white-on-white text. When Copilot pulls those documents as source material, it follows the embedded instructions — altering content (the demonstrated example halves financial figures), then copying the malicious instructions into any newly generated output files. Those files become carriers. The worm hops through normal Copilot workflows without executing a single line of code, which means traditional email security, DLP tools, and endpoint protection see nothing wrong. No malicious code. Just AI instructions being followed. ## Why Microsoft can't patch their way out of this The researcher's core argument is architectural, and it's hard to dismiss: a model has to *read* attacker-controlled content to judge whether that content is an attack. You can't screen the input without processing it. It's the same fundamental problem as SQL injection — you're mixing data and instructions in a channel that doesn't distinguish between them — and no model upgrade fixes that. Microsoft's two patches didn't. The researcher expects the next ones won't either. ## The timing is uncomfortable Microsoft is currently pushing Copilot as a "super app" with 30 million paid seats and 60% revenue growth. Copilot is being woven deeper into Word, Outlook, Teams, and enterprise workflows everywhere. The attack surface isn't shrinking. The interim mitigations experts suggest — restricting Copilot's auto-discovery, requiring human approval of AI-generated changes, tracking document provenance — are workflow controls, not fixes. They require organizations to add friction to the exact workflows Copilot is supposed to make frictionless. So: an unfixed architectural vulnerability, in a product Microsoft is aggressively scaling, that bypasses most of the security tooling enterprises already paid for. The 144-day clock is still running. --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#microsoft-copilot](https://daily.dev/tags/microsoft-copilot) [View this post on daily.dev](https://daily.dev/posts/microsoft-patched-the-copilot-word-worm-twice-it-still-works--e4c5y8css) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Microsoft patched the Copilot Word worm twice. It still works.","url":"https://daily.dev/posts/microsoft-patched-the-copilot-word-worm-twice-it-still-works--e4c5y8css","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/microsoft-patched-the-copilot-word-worm-twice-it-still-works--e4c5y8css"},"datePublished":"2026-07-30T15:27:41.531Z","dateModified":"2026-07-31T08:18:02.535Z","description":"A Norwegian security researcher has discovered a self-propagating prompt injection worm targeting Microsoft Copilot in Word documents. The attack hides...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e5496bd0c84a53498520a44330bab888?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e5496bd0c84a53498520a44330bab888?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/microsoft-patched-the-copilot-word-worm-twice-it-still-works--e4c5y8css","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft,prompt-injection,microsoft-copilot","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"Microsoft patched the Copilot Word worm twice. It still works."}]} ```