A self-replicating worm exploits Microsoft Copilot to spread through Office documents while bypassing standard security controls such as DLP and email filtering, with the underlying vulnerability still unpatched.