Prompt Injection Worm Discovered Targeting MS Word Copilot

This attack method, discovered by Håkon Måløy, is characterized by its evolution into a 'Worm' form that self-replicates within Microsoft Word by leveraging Prompt Injection.

Attack Mechanism:

• An attacker inserts hidden instructions (Hidden Instructions) into a document.
• When a user references the document via Copilot for Word, Copilot misinterprets these instructions as the user's own request and executes them.
• As Copilot carries out the instructions, it copies and inserts the same instructions into a new document as-is, turning the document itself into a new Carrier.
• As a result, even without the attacker's original document, the instructions continue to propagate to other documents through Copilot-supported workflows.

This vulnerability has been reported to Microsoft, but a complete mitigation capable of defending against this entire class of attack has not yet been established.