Document-borne AI worms can self-propagate through Copilot for Word
A coordinated vulnerability disclosure shows how attacker-written prompts hidden inside Word documents can hijack Microsoft Copilot, silently alter content (e.g., financial figures), and propagate themselves as “AI worms” into newly generated documents. Commenters connect this to the broader, unresolved problem that current large language models cannot reliably distinguish instructions from data, making them inherently vulnerable to prompt-injection-style attacks despite partial mitigations. The thread widens into concerns about embedding such agents deeply into office suites and operating systems, arguing that without stronger architectural and process safeguards, organizations risk large‑scale, hard‑to‑detect document tampering.
Vulnerability and Behavior
- Thread agrees the Word/Copilot issue is a real vulnerability class: document-borne prompts can hijack edits, alter content (e.g., numbers), and inject hidden payloads that propagate to new documents.
- Several note Microsoft added partial mitigations, but participants repeatedly stress that the general issue—LLMs executing attacker-supplied instructions in context—remains unresolved.
Instructions vs Data Debate
- Many frame this as the old “never mix code and data” lesson (SQL injection, macro viruses, in-band signaling) returning in AI form.
- Others argue “code vs data” is an artificial, context-dependent separation; general systems and human cognition don’t truly respect it.
- A strong counterpoint: for applications built on top of LLMs, you must enforce separation at the system level or abandon the approach for critical tasks.
Hidden Text and Document Handling
- Discussion of how “hidden” content appears: white-on-white text, tiny fonts, off-page text, covered by images, headers/footers/comments, even metadata.
- Some propose rendering-to-image and visibility checks, or stripping/flagging low-visibility text before sending to the model. Others note this is complex, costly, and still bypassable.
Comparisons to Past Worms and Viruses
- Many liken this to 1990s–2000s macro/VBScript worms, but with a twist: the worm payload can “improvise” and potentially evolve as different LLMs imperfectly copy it.
- Prior academic AI worms are mentioned; this is seen as one of the first in mainstream productivity software.
Mitigations and System Design
- Suggested defenses: don’t feed untrusted document content into agents; treat LLMs as untrusted human operators; sandbox tools; require explicit human approval for powerful actions; avoid local OS-level agents.
- Others point to multi-agent or classifier “firewall” designs, but note they remain fragile and circumvention-prone.
Human Analogies and Risk Perception
- One camp says prompt injection is fundamentally like social engineering against humans; you limit blast radius rather than seek perfect immunity.
- Another camp argues LLMs are uniquely vulnerable (opaque payloads, scale, no accountability) and far easier to exploit than humans.
Broader Reactions
- Tone ranges from alarmed (“LLMs as reckless toddlers with bash access”) to resigned cynicism about corporate incentives and user apathy.
- Some hope visible harms will force organizations to limit or ban deeply embedded AI agents; others doubt that will happen soon.