Context Collapse, Part 3 - AI Worming through Word
Coordinated disclosure with Microsoft MSRC / product teams. Public disclosure: 2026-07-28 after 144-day coordination.
Summary
Attacker-controlled instructions hidden in a Word document (e.g. white-on-white small text) can be read by Microsoft Copilot for Word as instructions because Copilot strips color/font formatting before sending text to the LLM. When the document is used as source material, Copilot may:
- Alter drafted/edited content (e.g. manipulate financial figures)
- Copy the malicious instructions into the new document, turning it into a new carrier
If the carrier is used in a later Copilot workflow, the attack propagates without the original malicious document. Among the first public demonstrations of document-borne AI-worm self-propagation in a mainstream commercial productivity suite (related prior art: Morris II in email-assistant ecosystems).
Disclosure status at publication
- Still exploitable after two Microsoft mitigation attempts (including “Edit with Copilot” changes and a model upgrade to GPT-5.5); researcher reproduced worming on GPT-5.6.
- Payload details withheld; class-level disclosure only.
- Customer mitigations: treat external docs as untrusted with Copilot; review attachments; review Copilot output before reuse/share.
Timeline (selected)
- 2026-03-06: Initial MSRC report
- 2026-03-31: Microsoft confirms behavior; first mitigation work begins
- 2026-04-03 / 04-09: First mitigation; reworded XPIA still works
- 2026-07-14: Second mitigation (model upgrade to GPT-5.5)
- 2026-07-15: Exploit reproduced on GPT-5.6
- 2026-07-28: Public disclosure; class still reproduces
Threat model: attacker needs only to share a malicious document—no tenant access required.