Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents ("Word Worm")
Hidden prompts tucked inside a Word document can be copied into the new files Microsoft Copilot for Word generates — a propagation The Register nicknames a "Word worm." A defender-focused look at the mechanism, the disclosure, and what stays unconfirmed.
Key Takeaways
|
Hidden prompts riding from one document into the next reframe an AI writing assistant as a propagation surface — and the exposure sits in the prompt-injection class, not in a single patchable flaw.
REDMOND, WASHINGTON — Microsoft Copilot for Word can copy hidden prompts embedded in one document into the new documents it generates, according to reporting published this week describing a coordinated disclosure by security researcher Hakon Maloy — a propagation The Register has nicknamed a "Word worm." The reported behavior turns an ordinary AI writing assistant into a path along which concealed instructions can travel from file to file as documents are reused.
As reported by The Hacker News and The Register, the issue is a form of prompt injection carried across documents rather than a conventional software flaw. This piece summarizes what the disclosure documents and what remains unconfirmed, in defender terms, without reproducing any injection payload.
| At a Glance | |
|---|---|
| Field | Details |
| What | Reports that Microsoft Copilot for Word can copy hidden prompts into new documents |
| Nickname | "Word worm" — coined by The Register |
| Class | Prompt injection carried across documents (no single CVE) |
| Researcher | Hakon Maloy, per reporting; disclosed to MSRC over a 144-day window |
| Vendor response | Microsoft reportedly deployed mitigations; researcher says the class persisted |
| Observed in the wild | Not reported observed in the wild — open question |
| Disclosure | The Hacker News and The Register, July 2026 |
What The Hacker News Reported
According to The Hacker News, Microsoft Copilot for Word can copy hidden prompts — instructions concealed inside a document so a human reader does not notice them — into the new documents the assistant produces. In defender terms, the assistant reads the full contents of a source document when it drafts or edits, and reporting indicates it does not reliably distinguish text the user intended as content from text placed there to act as instructions. When it writes a new document, the concealed instructions can be carried along into that output.
The disclosure is attributed to security researcher Hakon Maloy, who reportedly reported the behavior to the Microsoft Security Response Center and published after a 144-day coordinated-disclosure window. The CyberSignal is deliberately not reproducing the concealment method or any injection text; the defender-relevant facts are the affected feature — Microsoft Copilot for Word — the class of the finding, and the fact that the hidden prompts can move into newly generated files.
The Register's "Word Worm" Framing
In a follow-up, The Register framed the mechanism as a "Word worm" that crawls into Copilot and spreads through documents. The nickname captures the self-propagating quality reported: because a generated document can itself carry the hidden prompts, that document becomes a fresh source. If it is later fed back into Copilot for Word as reference material, the embedded instructions can fire again and re-embed themselves, so the pattern can travel through ordinary document reuse and collaboration.
The "Word worm" label is The Register's, and The CyberSignal attributes it accordingly rather than asserting it as a formal classification. What makes the framing useful for defenders is that it moves the story past a single manipulated file and toward the propagation property — the reason a hidden prompt in one document is not necessarily contained to that document.
The Prompt-Injection Attack Class
Underneath the nickname sits a familiar problem: prompt injection, here carried across documents. An assistant that ingests untrusted content and then acts on it cannot always tell the difference between the material it was asked to summarize and instructions hidden inside that material. That is not a defect in one product build with a version number to upgrade past; it is a property of how large-language-model assistants consume context, which is why there is no single bug to patch. The CyberSignal has tracked the same class in hidden instructions planted in an Azure DevOps MCP pull-request comment and in research on rogue AI swarms spreading through Model Context Protocol tooling.
What the Word disclosure adds is propagation inside a mainstream productivity workflow. It rhymes with a broader worry defenders have logged in research on a self-replicating AI-worm prototype, and it lands in the same product family as a prior Microsoft 365 Copilot data-exposure issue The CyberSignal covered. The through-line is that AI assistants wired into documents, repositories, and messages inherit the trust boundaries of whatever they read — and reading is now an action with consequences.
What Copilot-for-Word Tenants Should Verify
The practical posture here is not scan-and-patch but review-and-monitor, and it starts with a mindset shift: a document generated with AI assistance can carry instructions a person will not see. Tenants running Microsoft Copilot for Word can treat documents that arrive from outside the organization — and documents of unknown provenance reused as source material — as content to inspect before feeding them into the assistant, rather than as inert text.
Beyond that, defenders can confirm which Copilot mitigations their tenant is running and avoid assuming that a model upgrade alone closes the class, since reporting indicates it did not. Awareness across document-heavy teams — finance, legal, communications, where AI-assisted drafting from prior files is routine — is the cheapest control available while the class remains open. None of this requires reconstructing the technique; it requires treating AI-generated documents as material that may carry more than it appears to.
Open Questions
The vendor picture is more developed than a fresh disclosure usually is, and it is worth stating precisely. Microsoft reportedly acknowledged the behavior and deployed more than one round of mitigations during the disclosure window, and told The Register it uses layered safeguards to block malicious instructions; the researcher, however, reportedly reworked the approach to reproduce the broader class after those changes. The CyberSignal is not asserting the class is either fully fixed or fully open — only that reporting describes mitigations that did not, by the researcher's account, close it.
Other specifics stay unresolved. It is not confirmed whether other Copilot integrations — such as Excel or Outlook — exhibit similar behavior, nor the precise document-format vector, nor the scope of tenants affected, and the technique is not reported as observed in the wild. As Microsoft advisories, independent replication, or additional reporting emerge, the picture will sharpen; until then, this is a defender-oriented disclosure about a capability, not a confirmed campaign.
The CyberSignal Analysis
The reported facts above come from the disclosure and its reporting; what follows is The CyberSignal's editorial reading. None of the judgments below are new reported facts.
Signal 01 — The Fix Is a Boundary, Not a Patch
The instinct with any Microsoft finding is to ask which update closes it, and this one reportedly frustrates that instinct on purpose. Our reading is that the exposure is the trust boundary between what an AI assistant is told to do and what it reads while doing it — not a defect in one build. That is why mitigations can blunt a specific payload while the class survives a reworded one.
The consequence is to shift effort from patch-hunting to boundary-mapping: knowing where AI assistants ingest untrusted documents, and treating that ingestion as an action rather than passive reading, pays off regardless of whether this particular technique scales.
Signal 02 — AI-Generated Documents Are Now Part of the Supply Chain
The detail we find most durable is the propagation property. A document produced by an assistant can become a carrier for the next one, which means AI-generated files deserve the same provenance skepticism defenders already apply to third-party code and dependencies.
Our assessment is that document reuse — the ordinary habit of drafting from a prior file — is the transmission path worth watching. Organizations that treat internally generated documents as automatically trustworthy are the ones a cross-document injection would travel through fastest.
Signal 03 — Read It as Awareness, Not an Incident
This is a coordinated disclosure with mitigations already shipped, not an attack in progress, and the correct posture is calibrated attention rather than alarm. Treating it as an emergency would misallocate effort; dismissing it because nothing has been seen in the wild would waste a rare early warning about a mainstream workflow.
The useful middle is to log the "Word worm" as a capability to understand now and track as it matures. Defenders who grasp the cross-document prompt-injection seam today will read the next Copilot disclosure — or the first real-world attempt — far faster than those meeting the concept cold.
