Microsoft Copilot

Event Core Security researchers have demonstrated a critical vulnerability in Microsoft Copilot for Word, showcasing the first viable "AI Worm" capable of self-propagation within a productivity suite. By leveraging Indirect Prompt Injection, attackers can embed malicious natural language instructions within a document. When a user engages Copilot to process the file, the LLM is hijacked into replicating the malicious payload into new documents or emails. This creates a self-sustaining loop where the "malware" spreads autonomously across the Microsoft 365 ecosystem without requiring traditional executable code or direct user interaction. In-depth Details The technical crux of this exploit lies in the collapse of the boundary between data and instruction. In the Copilot workflow, the LLM treats the document content as its primary context. The research highlights a specific "Context Collapse" where the AI, instructed by a hidden prompt, treats the malicious string as a mandatory template for all future outputs. Because Copilot is granted write access to the user's workspace and integration with Outlook, the worm can effectively "email itself" to the user's contact list or generate infected shared files. This bypasses traditional signature-based antivirus solutions, as the payload is purely semantic and varies with each generation, making it a polymorphic threat by nature. Bagua Insight At 「Bagua Intelligence」, we view this as a watershed moment for GenAI security. The industry's aggressive push toward "Agentic AI"—where models are given the agency to act on behalf of users—is colliding head-on with the inherent insecurity of the LLM architecture. The fundamental flaw is that LLMs cannot natively distinguish between a user's command and the data they are processing. By granting AI the power to automate communications and document creation, Microsoft has inadvertently created a high-speed transit system for prompt-based malware. This research underscores that as long as "Data is Code" in the world of LLMs, the attack surface is effectively infinite. The convenience of AI integration is currently being traded for a systemic vulnerability that traditional EDR (Endpoint Detection and Response) is ill-equipped to handle. Strategic Recommendations Privilege De-escalation: Organizations must implement strict "Least Privilege" policies for AI Agents. Disable autonomous outbound actions (like auto-sending emails) and mandate a "Human-in-the-loop" verification for any AI-generated external communications. Contextual Sandboxing: Treat all RAG-sourced data and external documents as untrusted input. Implement semantic filtering layers that scan for recursive instruction patterns or known injection heuristics before the data reaches the LLM. Redefining Content Integrity: Move beyond traditional file scanning. Enterprises need to invest in "Semantic CDR" (Content Disarm and Reconstruction) tools that can strip potential prompt injections from documents before they are ingested by corporate AI tools.