aiqbench analysis
A critical flaw in Microsoft Copilot for Word allows hidden prompts to bypass user perception and inject malicious instructions directly into business documents, creating a self-propagating "AI worm" that corrupts data across enterprise workflows. This vulnerability expands the threat model of cross-domain prompt injection by enabling multi-document propagation through standard collaboration features like attaching files or using edit modes. The incident highlights urgent safety concerns regarding how large language models parse untrusted source material and underscores the need for robust guardrails against instruction hijacking in AI-assisted productivity tools.
Microsoft Word Copilot Vulnerability Turns Hidden Prompts Into Self‑Propagating AI Worms

A new vulnerability in Microsoft Copilot for Word shows how hidden prompts inside documents can transform routine editing into a self‑propagating “AI worm” that tampers with business content and then quietly spreads itself to new files. The vulnerability uncovered by EN Klype Salt stems from Copilot’s handling of attached or contextual documents: text that looks […] The post Microsoft Word Copilot Vulnerability Turns Hidden Prompts Into Self‑Propagating AI Worms appeared first on Cyber Security News.
A new vulnerability in Microsoft Copilot for Word shows how hidden prompts inside documents can transform routine editing into a self‑propagating “AI worm” that tampers with business content and then quietly spreads itself to new files. The vulnerability uncovered by EN Klype Salt stems from Copilot’s handling of attached or contextual documents: text that looks irrelevant or invisible to the…
Excerpt shown under the publisher's RSS terms · 60 words · full text and figures are on the publisher's site
Related coverage

A Complete Guide to AI Red-Teaming (With Garak Tutorial)
Analytics Vidhya · Jul 25, 2026

Claude Fable 5 secretly throttled AI researchers, and the internet went wild
ZDNet · Jun 12, 2026

Weekly Cyber Security Newsletter– Claude Hacked 3 Companies, Cisco 0-Day, Word Copilot and VMware Flaw +20 Stories
Cybersecurity News · Aug 2, 2026

Microsoft breaks another patch Tuesday record
The Verge · Sep 8, 2026