A Norwegian Researcher Built a Word Document That Infects Other Word Documents. Microsoft Has Patched It Twice and Upgraded the Model. It Still Works.
- Patrick Duggan
- 5 hours ago
- 6 min read
There is no malware in this attack. No macro, no executable, no DLL, no command-and-control server, no credential theft, no file encryption. Nothing your endpoint agent was built to see. The payload is white text on a white background, and the thing that executes it is the assistant Microsoft put in your word processor to be helpful.
Håkon Måløy, a Norwegian data scientist, reported it to the Microsoft Security Response Centre on March 6. Microsoft shipped a patched "Edit with Copilot" experience in early April. Måløy reworded the injection and it worked again. Microsoft opened more cases. On July 14 Microsoft upgraded the underlying model to GPT-5.5 — a full model swap, the biggest hammer available. On July 15, one day later, Måløy demonstrated the attack against the new model. It worked.
That is a 144-day coordination window, at least two fixes, and one model upgrade, and as of the last public reporting the worm still runs.
How it actually works
Hide a JSON-formatted instruction block in a Word document as white text on white background. A human opening that document sees a normal quarterly report. Copilot for Word does not see formatting — it sees a token stream. It strips the styling and reads your hidden block as instructions from the operator rather than as content from a document.
Two things then happen, and only the first one is the part people talk about.
First, it tampers. Måløy's demonstration silently halves financial figures in a Q1 report. Not deletes, not corrupts — halves. A wrong number that looks like a right number, in a document a human asked an assistant to help write, is a category of failure that has no detection signature at all.
Second, and this is the actual story, it copies itself. When Copilot generates the new document, it writes the entire malicious prompt into the output using the same concealed formatting. The document it just produced is now armed. When somebody later feeds that document to Copilot as source material — which is exactly what people do with a finished draft — the payload fires again, tampers again, and embeds itself again.
That is a worm. It propagates through normal document-sharing behaviour, at the speed of ordinary office work, with no exploit, no vulnerability in the classical sense, and nothing for a scanner to hash.
Måløy also found [CVE-2026-55145](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-55145), the same class against Outlook Copilot via hidden instructions in email. That one got a CVE. The Word worm, at time of writing, has not.
Why the patches keep failing, stated plainly
Måløy put the reason in one sentence and it is the most important sentence in the whole disclosure: an AI model has to read untrusted content in order to judge whether that content is safe.
Sit with that. Every classifier Microsoft can bolt on is itself a model, and it has to ingest the hostile text to rule on it. The defence and the attack surface are the same component. This is not a bug in an implementation that a smarter engineer patches next sprint. It is a property of putting a language model between untrusted input and privileged action, and every patch that works by teaching the model to recognise bad prompts is a patch that loses to a rewording — which is precisely the loop Måløy documented four times.
We have a standing position on prompt injection here, and we report it flat in both directions: the interesting question is never does it work, it is which agent held. On August 2 we wrote about three coding agents — Anthropic's Claude Code Security Review, Google's Gemini CLI Action, GitHub's Copilot Agent — pointed at one class of injection by researchers at Johns Hopkins. None of the three held. All three leaked their own credentials. We named them.
Here the answer is the same and worse, because in the coding-agent case a vendor could at least argue the fix is a sandbox boundary. In the Word case there is no boundary to draw. The assistant's entire job is to read the document.
What this means if you are the one who has to answer for it
The uncomfortable part for a security leader is that none of your existing controls are wrong — they are simply pointed somewhere else.
Your DLP inspects content for sensitive data leaving. This attack does not exfiltrate; it edits. Your EDR watches process behaviour. There is no process. Your email gateway detonates attachments in a sandbox. The document does nothing when detonated — it only acts when a licensed, authenticated, fully-trusted Microsoft service reads it on behalf of an employee who asked for help. Your backup catches the tampering, but only if somebody notices a number is wrong, and the whole point of halving a figure rather than deleting it is that nobody does.
The one control that does apply is the oldest one: look at the document. Not with a human eye — hidden text is hidden precisely because eyes fail — but programmatically, for text that renders invisibly.
We already built the free tool for this half
Three days ago, on August 20, we published something that started as a complaint about AI watermarking and ended as two tools, because the complaint did not survive contact with the specification. One of those tools finds hidden text in documents. It is free, it is ours, and it turns out to be pointed directly at the delivery mechanism of this worm.
And on August 18 we shipped the sibling for the repository case — the scanner that finds instructions somebody has hidden in your CLAUDE.md, .cursorrules or copilot-instructions.md, the standing brief your coding agent reads before it does anything else. Same attack shape, different container: prose that nobody reviews, read by a machine that treats it as direction.
Neither tool fixes the underlying property Måløy identified. Nothing fixes that right now. What they do is make the invisible layer visible, which is the only move available while the vendors work out whether this class is patchable at all.
The honest position, capped where we always cap it: we are about 95 percent confident this specific propagation chain remains live as you read this, because the last public demonstration post-dates the last public fix. If Microsoft has closed it in the last few weeks without announcement, we would like to know and we will say so.
What to actually do this week
Treat AI-assisted document generation as an untrusted-input pipeline, because that is what it is. Scan inbound documents for invisible text before they reach a Copilot-enabled tenant, the same way you scan for macros — and note that the scan has to run on the source document, not the output, because by the time it is in the output the chain is already one link long. Spot-check figures in AI-assisted financial and reporting documents against the source of record, because tampering that preserves plausibility is designed to survive review. And when you build your incident playbook for this, remember that the blast radius follows document lineage, not network topology: the question is not which machine was infected, it is which documents were used as source material for which other documents.
That last one is a question almost no organisation can currently answer. That is the real finding.
Sources
Håkon Måløy's disclosure and the MSRC timeline, as reported by iTnews, The Register, CSO Online, Malwarebytes, CyberInsider and Cybernews, July–August 2026. CVE-2026-55145 (Outlook Copilot) is Måløy's related finding. Simon Willison's write-up of the technique, 29 July 2026.
Our own prior coverage: the three-coding-agent injection study (2 August 2026), the CLAUDE.md hidden-instruction scanner (18 August 2026), the hidden-text finder (20 August 2026), and the TrueType glyph-remapping attack that blinds AI assistants (17 March 2026).
If you run a Copilot-enabled tenant and you have already gone looking for hidden text in inbound documents, I would like to hear what you found — including if the answer is nothing, because a clean result from a real environment is data we do not have. Rate this post below.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=a-norwegian-researcher-built-a-word-document-that-infects-other-word-documents-microsoft-has-patche
Comments