AI worms? In your Copilot PC? According to this AI researcher, it’s more likely than you think
Security researcher Håkon Måløy has identified a significant vulnerability in Microsoft’s Copilot for Word that could enable what researchers are calling an “AI worm.” The attack exploits how Copilot processes source documents by embedding hidden instructions that the AI agent interprets as legitimate user requests.
In the attack scenario, an attacker places concealed instructions within a document that is later used as source material for Copilot. The AI system fails to distinguish between the attacker’s hidden commands and the user’s actual requests, causing it to manipulate documents being drafted or edited without the user’s knowledge. This capability represents a novel attack vector that leverages the autonomous nature of agentic AI systems.
The vulnerability highlights fundamental security challenges in deploying AI agents in productivity software. Unlike traditional AI assistants that primarily respond to explicit user queries, agents operate with greater autonomy and access to user data and document repositories. This expanded capability surface creates opportunities for attackers to weaponize documents as attack delivery mechanisms.
The research underscores growing concerns about integrating AI agents into enterprise tools before adequate security safeguards are established. Organizations using or considering AI-powered productivity features may need to implement additional security measures, including instruction validation, document sandboxing, and comprehensive auditing of AI-performed operations, to prevent similar exploitation.