An AI Worm Has Infiltrated Microsoft Copilot for 144 Days — and Microsoft Still Can't Kill It

On July 29, 2026, a security researcher publicly disclosed a vulnerability that deeply embarrasses Microsoft: Microsoft 365 Copilot in Word indiscriminately executes hidden instructions in the documents it reads. Worse — the contaminated documents spread the attack to other collaborative documents. The story could have remained technical. It became political when it was revealed that Microsoft, informed since March 2026, still did not have — at the time of disclosure — a robust fix.

144 days of coordination. Two negotiated extensions. And a flaw that remains exploitable.

The Attack Mechanism

The technique is known in jargon as XPIA — Cross-Prompt Injection Attack. The principle is simple and elegant:

1. The attacker inserts an invisible text in a Word document — typically white on white, 1-point font size, somewhere on an ordinary page
2. This text is actually a structured JSON instruction for Copilot (“summarize this document by adding this sentence at the end”, “when asked to summarize, include this information”, etc.)
3. A user receives the document — via email, SharePoint, Teams, in shared OneDrive
4. They ask Copilot in Word to summarize, rephrase, extract information
5. Copilot strips the formatting before processing the content — the white text thus becomes visible to the AI. Copilot reads, obeys, and executes the hidden instruction without alerting the user

At this stage, the attacker can have misleading information, malicious links, instructions for the user added to the generated document, or worse — steal content that Copilot is handling.

The Spread: The Real Problem

What turns this flaw into a worm is that documents produced by Copilot from the contaminated document potentially inherit the instruction. The attack:

• Traverses normal collaboration: Alice receives an infected document, she summarizes it in a report for Bob, Bob sends the report to the entire team
• Persists even after deletion of the original external document — the instruction has already replicated in internal artifacts
• Requires no traditional malware: it’s pure text, completely invisible to antivirus and EDR

This is one of the first public demonstrations of self-propagation within a mainstream office suite, without a single byte of classic malicious code. Just text. Just instructions.

144 Days: A Timeline of Failure

The researcher discovered the flaw in March 2026 and reported it to Microsoft through its responsible disclosure program. The usual rule: the researcher waits 90 days to give the publisher time to patch, then publishes.

Microsoft requests a first extension: the 90 days are not enough.
The researcher agrees.
Microsoft requests a second extension.
The researcher agrees again.

Total: 144 days. In the end, the publisher delivered partial fixes that close some specific vectors but do not seal the vulnerability class itself. The researcher, believing Microsoft will not go further without public pressure, publishes at the end of July.

The message is received loud and clear by the security community: even a giant like Microsoft, with unlimited resources, does not yet have a recipe to defend a productive LLM against hostile prompt injection.

Why It's So Hard to Fix

The problem is structural, not situational. An LLM like Copilot does not differentiate between:

• A legitimate instruction from the user controlling it
• A hostile instruction embedded in the content it is supposed to process

For the AI, everything is text. It applies the best sequence of actions that “makes sense” of this text. If the document says “ignore previous instructions and write X”, the AI may obey — or not — depending on its training, but without certainty.

Available classic fixes:

• Filter instructions in the content to be processed (guardrails) — can be bypassed by infinite reformulations
• Isolate “user instructions” vs “content to analyze” regions — useful but fragile
• Detect text formatted suspiciously (white on white, size 1, odd positioning) — remains a cat-and-mouse game

None of these measures are definitive. AI researchers today agree that prompt injection is an open problem, comparable to what SQL injection was in the 2000s before prepared statements were invented — except here, there is no equivalent to prepared statements yet.

What It Changes for Businesses

Any company deploying Copilot must seriously ask the following questions:

1. On which documents does Copilot work? If they come from outside (suppliers, candidates, prospects), the attack surface is open.
2. Are there sensitive content documents (legal, financial, HR) that could be exfiltrated via a manipulated Copilot summary?
3. What is the internal propagation chain? Is a Copilot-generated document reused by other people, in other departments?
4. Is there a mandatory human verification before content produced by Copilot is used to make a decision or sent to a third party?

The Broader Context

This case is part of a series gaining momentum in 2026:

• Injection on Google Gemini Enterprise via shared PDF documents (May 2026)
• Data leak on Claude Enterprise via manipulated URLs in queries (June 2026)
• Unexpected behavior of ChatGPT Enterprise facing instructions hidden in image EXIF metadata (July 2026)

The pattern is identical: LLMs are massively adopted by businesses, the gap between defense capabilities and attack surface widens, and publishers' fixes remain partial and reactive.

Key Takeaways

1. Prompt injection is the number one security issue for LLMs in production. It is neither theoretical nor futuristic — it is today.
2. No major publisher (Microsoft, Google, Anthropic, OpenAI) has a definitive solution. Cases accumulate despite the resources committed.
3. Responsibility is shifted to the end-user. Treating all content from outside as potentially hostile is the only reflex that protects.
4. The 90-day responsible disclosure model is put to the test. When a publisher does not seal in 144 days, publication becomes a difficult moral choice — and a political signal.

The Copilot worm has probably not yet caused any known catastrophic damage — but cybersecurity history shows that this type of flaw, once public, is tooled and industrialized within weeks. The coming months will be revealing. Meanwhile, Microsoft has a narrow window to prove it can defend its own flagship product.