A hidden instruction in a Word document can now copy itself into the next document

Hakon Maloy demonstrated a prompt-injection variant that upgrades into a self-replicating worm. Hidden instructions in a document used as source material for Copilot for Word can be read as part of the user's request, and Copilot can then copy those instructions into the document it produces - turning the output into a new carrier that fires again in the next Copilot-assisted edit, without the attacker's original file being present. Simon Willison notes it is the first hidden-text attack he has seen that deliberately self-replicates. It was disclosed to Microsoft 144 days before publication and there is still no mitigation covering the full class.

What it means Every document your assistant reads is now potentially a carrier, and it spreads through ordinary drafting - the file-sharing habits of a normal team are the attack surface.