Full Report
Researcher says months of coordination with Microsoft have yet to produce a robust mitigation
Analysis Summary
# Vulnerability: Cross-Domain Prompt Injection (XPIA) AI Worm in Microsoft Copilot
## CVE Details
- **CVE ID**: Not yet assigned (Disclosed via coordinated vulnerability disclosure).
- **CVSS Score**: N/A (Severity is high due to self-propagating nature and impact on data integrity).
- **CWE**: CWE-1039 (Realization of unsafe queries or commands from untrusted inputs in AI/ML).
## Affected Systems
- **Products**: Microsoft Copilot for Word; Microsoft 365 productivity suite.
- **Versions**: All current versions as of July 2026.
- **Configurations**: Any instance where Copilot is used to process, summarize, or generate documents using externally sourced or untrusted "source material" in its context window.
## Vulnerability Description
This vulnerability is a **Cross-Domain Prompt Injection (XPIA)** that enables a self-propagating "AI worm." The flaw exists because the Large Language Model (LLM) powering Copilot fails to distinguish between system instructions and data provided within a document.
An attacker can embed malicious instructions (e.g., hidden as small white text) in a Word document. When a user asks Copilot to interact with that document (e.g., "Summarize this file" or "Use this to draft a report"), the LLM follows the hidden instructions. These instructions can:
1. **Manipulate Output:** Silently alter data, such as financial figures, in the new document.
2. **Self-Propagate:** Command Copilot to copy the malicious payload into the newly generated document. This ensures that any subsequent user who uses the child document as a reference for Copilot will also be compromised, creating a worm-like propagation through normal workflows.
## Exploitation
- **Status**: PoC available (Researcher confirmed successful execution; payload details currently withheld to prevent exploitation).
- **Complexity**: Medium (Requires crafting specific prompt payloads that bypass existing safeguards).
- **Attack Vector**: Network/Document-borne (Attacker shares a malicious document or hosts it on a website).
## Impact
- **Confidentiality**: Low (Primary focus is on manipulation rather than exfiltration).
- **Integrity**: **High** (Hidden alteration of data and financial figures in enterprise reports).
- **Availability**: Low (Does not necessarily crash the system, but corrupts the output reliability).
## Remediation
### Patches
- **None robust**: As of July 2026, Microsoft has attempted two mitigations (including a model upgrade), but testing shows the **vulnerability class remains open**.
### Workarounds
- **Manual Document Review**: Manually inspect all externally sourced documents for hidden text or anomalies before including them in Copilot’s context.
- **Output Verification**: Thoroughly review and fact-check all content generated or edited by Copilot for accuracy and integrity.
- **Limit Context**: Avoid using Copilot to process documents from untrusted or unverified sources.
## Detection
- **Indicators of Compromise**: Presence of unexpected "hidden" text (e.g., font size 1, white color) within Word documents that contains instructional language directed at an AI.
- **Detection methods**: Content scanning tools that identify "prompt-like" signatures within document metadata or hidden layers; manual "Select All" with color change to reveal hidden text.
## References
- **Researcher Blog**: hxxps[://]enklypesalt[.]com/posts/context-collapse-part3-ai-worming-through-word/
- **Vendor**: Microsoft Security Response Center (MSRC) - No specific advisory link provided in text.