Claim◆Article
Håkon Måløy discovered a prompt injection variant against Microsoft Word that achieves full self-replicating worm behavior.
Security researcher Håkon Måløy found a prompt injection technique against Microsoft Word's Copilot that can self-replicate like a worm. ✦ AI generated
Article author · Simon Willison's Weblog · 2026-07-29 · original ↗
Neat new prompt injection variant by Håkon Måløy, who found a way to upgrade prompt injection attacks against Microsoft Word to full self-replicating worms
Read full article ↗excerpt · fair-use quotation
- ·Håkon Måløy discovered a new prompt injection variant
- ·Targets Microsoft Word's Copilot integration
- ·Upgrades standard prompt injection to full worm behavior
- ·Achieves self-replication without user intervention
- ·First documented worm-capable prompt injection in Office
- ·Self-replication enables lateral spread across documents
- ·Shifts prompt injection from nuisance to autonomous threat
Around this claim
Mechanism · 2
An attacker places hidden instructions in a source document that Copilot for Word interprets as part of the user's request, causing it to manipulate the document being edited and copy the instructions into the output, turning that output into a new carrier document.Article author · Simon Willison's Weblog · conf 90%A carrier document, when used in subsequent Copilot-assisted workflows, triggers the hidden instructions again and propagates them into further documents even without the attacker's original document being present.Article author · Simon Willison's Weblog · conf 90%
Context · 2
While hidden white-on-white text is a known technique, this attack is the first to deliberately copy instructions into outputs to achieve self-replication.Article author · Simon Willison's Weblog · conf 85%The vulnerability was responsibly disclosed to Microsoft 144 days ago with no mitigation that covers the full class of attack produced so far.Article author · Simon Willison's Weblog · conf 80%