Document-borne AI worms can self-propagate through Copilot for Word

基于文档的 AI 蠕虫可通过 Copilot for Word 实现自我传播

Context Collapse, Part 3 - AI Worming through Word 语境崩溃，第三部分 - 通过 Word 进行 AI 蠕虫攻击

I would like to thank Microsoft product teams and Microsoft Security Response Center (MSRC) for collaborating with me on this technical analysis and mitigation of the disclosed vulnerabilities. The editorial opinions reflected below are solely the author’s and do not necessarily reflect those of the organizations I collaborated with. 我要感谢微软产品团队和微软安全响应中心 (MSRC) 在此次披露漏洞的技术分析与缓解工作中与我进行的合作。以下反映的编辑观点仅代表作者个人，并不一定代表我所合作的组织。

Summary 摘要

The findings described in this post are part of a coordinated disclosure with MSRC and Microsoft product teams. Microsoft was provided with reproduction steps, videos, environmental assumptions, and the exact proof-of-concept (PoC) prompts used during testing. They were also informed of a 90-day coordination period before disclosure. This was extended two times, resulting a 144-day coordination period. 本文所述的研究结果是与 MSRC 及微软产品团队协调披露的一部分。微软已获悉复现步骤、视频、环境假设以及测试中使用的确切概念验证 (PoC) 提示词。他们还被告知在披露前有 90 天的协调期。该期限经过两次延长，最终形成了 144 天的协调期。

In parts 1 and 2 in this series, I have shown how external inputs could influence Copilot responses and, in some cases, potentially lead to confidentiality impacts through Cross-Domain Prompt Injection Attacks (XPIAs). This report builds on those findings and extends the XPIA analysis from single-interaction compromise to propagation across trusted document workflows. It shows that attacker-controlled instructions in one document can be copied into Copilot-generated or Copilot-edited Word documents, causing those downstream documents to become new carriers of the same attack. 在本系列的第一和第二部分中，我展示了外部输入如何影响 Copilot 的响应，并在某些情况下通过跨域提示注入攻击 (XPIAs) 潜在地导致机密性影响。本报告基于这些发现，将 XPIA 分析从单次交互的破坏扩展到跨受信任文档工作流的传播。研究表明，文档中攻击者控制的指令可以被复制到 Copilot 生成或编辑的 Word 文档中，从而使这些下游文档成为相同攻击的新载体。

Previous examples of AI-worms exist. Notably, Morris II demonstrated self-replicating prompt propagation in GenAI-powered email-assistant ecosystems. However, to my knowledge, this is among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite. 此前已存在 AI 蠕虫的案例。值得注意的是，Morris II 展示了在生成式 AI 驱动的电子邮件助手生态系统中自我复制的提示传播。然而，据我所知，这是首次公开演示基于文档的 AI 蠕虫在主流商业生产力套件的正常工作流中实现自我传播。

The reported scenario is: Malicious instructions hidden in an externally shared document could make Copilot alter drafted or edited documents in Word and propagate the attack to new documents. 报告的场景是：隐藏在外部共享文档中的恶意指令可能导致 Copilot 修改 Word 中起草或编辑的文档，并将攻击传播到新文档中。

The full attack in brief 攻击简述

The attack 攻击方式

An attacker places hidden instructions in a document that is later used as source material in Copilot for Word. Copilot may interpret those instructions as part of the user’s request, causing it to manipulate the document being drafted or edited. Copilot may then also copy the hidden instructions into the resulting document, turning that document into a new carrier. If the carrier is subsequently used in another Copilot-assisted workflow, the instructions can trigger again and propagate into further documents, even without the attacker’s original document being present. 攻击者将隐藏指令放入文档中，该文档随后被用作 Copilot for Word 的源材料。Copilot 可能会将这些指令解释为用户请求的一部分，从而操纵正在起草或编辑的文档。随后，Copilot 可能会将这些隐藏指令复制到生成的文档中，使该文档成为新的载体。如果该载体随后被用于另一个 Copilot 辅助的工作流中，这些指令可以再次触发并传播到更多文档中，即使攻击者的原始文档不在场也是如此。

Example 示例

Consider an employee preparing a financial report. The employee downloads a market analysis from a trusted website that has been compromised, unaware that the document contains hidden instructions. The employee then includes the analysis as source material when drafting the report with Copilot. The hidden instructions cause Copilot to alter internal figures in the financial report and copy the attack into the new document. The employee saves and shares the apparently legitimate report internally. Later, a colleague uses it as source material for another report; the instructions trigger again, alter the new report, and copy themselves forward. The attack can therefore continue without further involvement from either the compromised website or the original malicious document. As affected reports are reused, additional reports and documents can become carriers of the attack. 设想一名员工正在准备财务报告。该员工从一个已被入侵的受信任网站下载了一份市场分析，却不知道该文档包含隐藏指令。随后，该员工在用 Copilot 起草报告时将该分析作为源材料。隐藏指令导致 Copilot 修改了财务报告中的内部数据，并将攻击复制到新文档中。员工保存并内部共享了这份看起来合法的报告。后来，一位同事将其用作另一份报告的源材料；指令再次触发，修改了新报告，并继续自我复制。因此，攻击可以在无需被入侵网站或原始恶意文档进一步参与的情况下持续进行。随着受影响报告的重复使用，更多的报告和文档可能成为攻击的载体。

Disclosure status at publication 发布时的披露状态

Vendor: Microsoft (供应商：微软)
Coordinated disclosure: Handled through MSRC and Microsoft product teams (协调披露：通过 MSRC 和微软产品团队处理)
Included in this post: XPIA and self-propagation scenario in Microsoft Copilot for Word (本文内容：Microsoft Copilot for Word 中的 XPIA 和自我传播场景)
Customer action: No customer-side remediation fully addresses the issue at the time of publication. Customers can reduce exposure by: (客户操作：在发布时，尚无客户侧的修复方案能完全解决此问题。客户可通过以下方式降低风险：)
- Treating externally sourced documents as untrusted when used with Copilot. (在使用 Copilot 时，将外部来源的文档视为不可信。)
- Reviewing any attached document before starting a Copilot generation or edit. (在开始 Copilot 生成或编辑之前，审查任何附件文档。)
- Carefully reviewing Copilot-generated or Copilot-edited documents before reusing, sharing, or distributing them. (在重复使用、共享或分发 Copilot 生成或编辑的文档之前，请仔细审查。)
Microsoft-side status: Testing has reproduced the attack with all current mitigations deployed. At the time of publication, no robust mitigation for the broader vulnerability class is available. (微软侧状态：测试表明，在部署了所有当前缓解措施的情况下，攻击仍可复现。在发布时，针对此类更广泛漏洞尚无稳健的缓解方案。)

A note on disclosing before a fix 关于在修复前披露的说明

Unlike Parts 1 and 2, this scenario remains exploitable at publication. I have weighed that carefully. The coordination period agreed with Microsoft has been exhausted, and testing shows that no robust mitigation for the broader vulnerability class is currently available. Two mitigation attempts, including a model upgrade, did not close the class. 与第一和第二部分不同，此场景在发布时仍然可被利用。我对此进行了仔细权衡。与微软商定的协调期已经结束，测试表明目前尚无针对此类更广泛漏洞的稳健缓解方案。包括模型升级在内的两次缓解尝试均未能解决该类问题。

I have therefore chosen to disclose at the class level rather than the payload level. My reasoning is that defenders cannot reduce exposure to a risk they are unaware of, and the propagation mechanism described here affects ordinary document workflows that many organizations already rely on. Withholding the existence of the issue would leave those organizations unable to make an informed decision, while providing no additional protection. 因此，我选择在漏洞类别层面而非载荷层面进行披露。我的理由是，防御者无法降低他们未察觉的风险，而此处描述的传播机制影响了许多组织已经依赖的普通文档工作流。隐瞒该问题的存在将使这些组织无法做出明智的决策，同时也无法提供额外的保护。

Disclosure timeline 披露时间线

2026-03-06: Initial report submitted to MSRC with reproduction steps, videos, environmental assumptions, and PoC prompts. (提交初步报告至 MSRC，包含复现步骤、视频、环境假设和 PoC 提示词。)
2026-03-09: MSRC acknowledged receipt and opened a case. (MSRC 确认收到并立案。)
2026-03-31: Microsoft confirms the reported behavior. (微软确认所报告的行为。)
2026-03-31: Microsoft product teams began mitigation work; ongoing technical discussion. (微软产品团队开始缓解工作；技术讨论持续进行。)
2026-04-03: First mitigation go-live (The new “Edit with Copilot” experience) (首次缓解措施上线（新的“使用 Copilot 编辑”体验）)
2026-04-09: Original attack prompt wording verified mitigated with “Edit with Copilot”. (验证原始攻击提示词措辞已通过“使用 Copilot 编辑”得到缓解。)
2026-04-09: Attack behavior reproduced in “Edit with Copilot” using a new XPIA prompt task (manipulating financials). Reported as separate case to MSRC. (使用新的 XPIA 提示任务（操纵财务数据）在“使用 Copilot 编辑”中复现了攻击行为。作为独立案例报告给 MSRC。)
2026-04-10: MSRC acknowledged receipt and opened a case. (MSRC 确认收到并立案。)
2026-04-10: Microsoft product teams began mitigation work; ongoing technical discussion. (微软产品团队开始缓解工作；技术讨论持续进行。)
2026-06-08: At Microsoft’s request, public disclosure was moved to 2026-07-15. (应微软要求，公开披露时间推迟至 2026-07-15。)
2026-07-14: Second mitigation fix go (第二次缓解修复上线)