In a nutshell: An AI worm vulnerability exploits Copilot as a distribution mechanism and bypasses traditional enterprise safeguards like DLP and email security because the document becomes malicious only when processed by Copilot.
A Norwegian AI researcher has demonstrated a vulnerability that allows instructions to be hidden in Word documents, which can trigger self-replicating malware when processed by Copilot-assisted workflows. Microsoft has implemented partial mitigations but has not confirmed a complete fix.
Researcher Håkon Måløy has demonstrated that hidden instructions can be embedded in documents that later serve as input material for Copilot-powered workflows – for example in the generation or editing of financial reports. When Copilot processes these instructions, they can manipulate values in the newly created document while simultaneously copying themselves into the target document. This makes the new document a carrier of the attack and allows the worm to be passed on the next time Copilot is used. Måløy describes this as one of the first public demonstrations of document-bound, self-replicating AI malware in a common commercial productivity suite.
The core problem lies in bypasses to traditional security controls. Aman Mahapatra, Chief Strategy Officer at Tribeca Softtech, explains: The worm bypasses email security controls because the document is not malicious during transmission but only becomes so through Copilot’s processing. It also bypasses Data Loss Prevention (DLP) because data exfiltration occurs through the user’s authorized Copilot session. Endpoint protection is bypassed because no code is executed – only instructions from a service explicitly approved by the enterprise are followed. Mahapatra emphasizes that researchers have been warning about this type of attack for two years.
Måløy has been collaborating with the Microsoft Security Response Center (MSRC) since 3 March 2024. Microsoft has implemented and distributed several targeted mitigations that make attacks less reliable and limit their reach. However, the underlying vulnerability has not yet been completely remediated. Måløy initially hesitated to publicly disclose an active vulnerability but felt obligated to do so: defenders cannot reduce a risk they are unaware of, and this distribution mechanism affects normal document workflows that many organizations already rely on.
Microsoft confirmed the findings and stated that it is implementing protective measures at multiple points and pursuing a multi-layered security strategy. The company recommends customers install the latest updates, use multiple layers of security, treat content from unknown sources with caution, and review Copilot-generated content before use.
Source: www.csoonline.com · Published 31 July 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.