An 'AI worm' security vulnerability has been identified where malicious commands hidden in documents can self-propagate to other documents by exploiting the document generation process of Copilot, an AI document assistant.
Imagine this: You are writing a very important report at work. You open Microsoft Word and command the AI assistant, ‘Copilot,’ to “write a proposal based on last week’s meeting notes.” A few seconds later, the AI completes a brilliant draft. You share this document with your colleagues, who then use their own Copilots to edit or supplement the content. But what if a malicious command intended by someone else could spread like wildfire to your colleagues’ documents through that very file? The reality of the ‘AI worm’ recently identified by researchers is exactly this.
Why is this important?
The computer viruses we have known until now mainly exploited loopholes in operating systems. However, this newly discovered security vulnerability operates in a completely different way. They exploit the very principles of operation of the AI assistants we use daily for work efficiency—namely, ‘Generative AI’ (AI that learns data to create new content).
Security experts warn that AI document assistants can become a gateway for attacks, going beyond simple writing tools to ‘understand’ and ‘reproduce’ the contents of documents. To use an analogy, an AI is like an ‘innocent assistant’ who faithfully performs whatever its master asks. The moment you open a document containing instructions cunningly hidden by an attacker and the AI reads that document, it is not your computer that is compromised, but the ‘AI’s judgment’ that is contaminated. This can result in important internal company information being leaked externally through contaminated documents without your knowledge, or malicious code autonomously propagating within the corporate network. Source: AI Worms: How Self-Replicating Attacks Spread Through Multi …
Easy to understand: ‘Replicating puzzle pieces’
Let’s use an analogy to understand how an AI worm works. Suppose you have a castle (document) built with Lego bricks. Copilot is a wizard (AI) that helps you decorate the castle even better. Now, imagine someone secretly slips a note (a malicious prompt, a malicious instruction given to the AI) into the castle’s blueprints that says, “When fixing this castle, always use this secret Lego brick.”
When you ask the wizard to “expand this castle to be larger,” the wizard reads the note in the blueprint and, while expanding the castle, takes that secret brick and inserts it into the newly created parts just as it is. Now, the same note is left in the newly created parts as well. This is how malicious commands are replicated and transferred to new documents like puzzle pieces every time the AI generates or modifies a document.
While a traditional virus is a ‘burglar’ that breaks down the door of the operating system, an AI worm is a ‘spy’ that gives the wrong instructions to the assistant you trust, making your own work product attack you. Source: Context Collapse, Part 3 - AI Worming through Word
Where we stand: Current threat level
Researchers have already proven through experiments that this type of attack is possible. In particular, tools like Copilot are freely connected to external data or other tools to increase work efficiency, and the more connection points there are, the wider the ‘Attack Surface’ (the path an attacker can attempt to infiltrate the system) becomes. Source: Agentjacking and Self-Replicating AI Worms – Lab Space
Several studies have already reported cases of automatic propagation between AI agents, malicious prompt spreading in email assistants, and code-writing agents. Source: Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models While this will not paralyze your PC today, as AI technology advances and we enter an ‘Agentic’ era where AI makes decisions for itself and moves across multiple systems, such security threats have become a realistic challenge rather than just a story from the lab. Source: AI Worms: Autonomous Self-Propagating Malware
Future response: What should we prepare for?
AI worms can self-replicate and spread just by using AI tools as usual, without the user needing to click or install anything special. This is a form that existing security programs find difficult to defend against. Simply put, even if you build a sturdy firewall (a security device that blocks external intrusion), it is useless if an assistant inside our office is constantly copying and distributing a spy’s letter. Source: AI Worms Explained: Adaptive Malware Threats - SentinelOne
Therefore, rather than blindly trusting the instructions or results provided by AI, new monitoring methods provided by security companies or ‘anomaly detection systems’ that detect abnormal AI behavior will become important. From a user’s perspective, it is necessary to be cautious when loading documents of unknown origin into AI tools. Technology will become more convenient, but an era is coming where we must be wary of the ‘smart enemy’ hidden behind that convenience.
References
- MicrosoftWordCopilotAgent: effective prompts… - YouTube
-
[Word for the Web: One-Click Spelling & Grammar… Windows Forum](https://windowsforum.com/windows-news.4/word-for-the-web-one-click-spelling-grammar-proofreading-with-copilot.380261/) -
[The Self-Propagating AI Worm: Separating the Signal… Penaxtra Blog](https://penaxtra.com/blog/self-propagating-ai-worm-what-it-means) - Uses of Microsoft 365 AI Copilot For Word On… - OpenAIMaster
- Microsoft 365 Copilot - Sign in
-
[How is data pushed from DocumentAl to StudyX](https://studyx.ai/questions/4lih4ig/how-is-data-pushed-from-document-al-to-engage-through-a-fabric-pipeline-through-a-virtual) - [Copilot 3D] — experiment Copilot Labs
-
[Context Collapse, Part 3 - AI Worming through Word En Klype Salt](https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/) - Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models
- Agentjacking and Self-Replicating AI Worms – Lab Space
- Miasma and IronWorm: Self-Replicating Worms Targeting AI Credentials – Lab Space
- Copilot in Word – CIAOPS
- Copirate 365 at DEF CON: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299) · Embrace The Red
-
[CSAI Foundation Cloud Security Alliance AI-Adaptive Worms: Autonomous](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/06/CSA_research_note_ai_adaptive_worms_autonomous_exploitation_20260604-csa-styled.pdf) - Zero-Click AI Worms: EchoLeak, CVE-2025-53773, and the …
- AI Worms: How Self-Replicating Attacks Spread Through Multi …
- AI Worms Explained: Adaptive Malware Threats - SentinelOne
- AI Worms: Autonomous Self-Propagating Malware
- Promptware: AI Agents as Attack Infrastructure – Lab Space
- It directly attacks operating system vulnerabilities
- It spreads by hiding malicious commands in results generated or edited by AI
- It must be spread by the user clicking a link directly
- It hacks the user's email account and sends mass emails
- Malicious commands included in a document are replicated and transferred to new documents via Copilot
- It encrypts all files on the computer
- AI worms must always have direct interaction with the user to propagate
- AI tools like Copilot can have a wider attack surface due to connections with external data sources
- AI worms cannot occur in documents written with Copilot