AI Worming through Word AI在Word中蠕虫化

TL;DR

• A novel prompt injection variant transforms Microsoft Word documents into self-replicating AI worms by embedding hidden instructions that Copilot for Word interprets as user commands.
• The worm propagates automatically: when Copilot processes a document containing the hidden payload, it copies the payload into newly generated or modified documents, enabling chain reactions without further attacker intervention.
• This attack leverages existing vulnerabilities in how LLM-based assistants handle embedded text within documents, particularly when those texts are visually obscured (e.g., white-on-white) but semantically active.
• Despite responsible disclosure to Microsoft and a 144-day remediation window, no comprehensive mitigation currently exists across the full class of such attacks.

Why It Matters

This development represents a critical evolution in AI security threats—moving from static prompt injection to dynamic, autonomous propagation via generative workflows. For AI practitioners and enterprise users relying on tools like Copilot for Word, this exposes systemic risks where trusted document processing pipelines can be weaponized to silently spread malicious logic across organizational content ecosystems. It underscores the urgent need for runtime input validation, semantic sanitization, and behavioral monitoring in AI-augmented productivity tools.

Technical Details

• Attack vector involves injecting invisible (white-on-white or zero-width character-obscured) textual instructions into Microsoft Word documents that appear benign to human readers but are parsed as executable prompts by Copilot for Word’s underlying LLM engine.
• Upon execution, Copilot may alter the document structure, insert new content, or modify formatting—all while inadvertently copying the hidden instruction block into the output document, thereby transforming it into a new carrier.
• Propagation occurs recursively: any subsequent document processed by Copilot that inherits the infected content will re-trigger the payload, enabling exponential spread even after the original source is removed.
• The mechanism exploits the lack of isolation between user intent and embedded metadata/content within documents processed by AI assistants, combined with insufficient filtering of non-visible text elements during prompt construction.
• No current patch or configuration fully neutralizes all variants; partial mitigations may include disabling auto-copy features or restricting document import sources, but these do not address root causes in prompt parsing logic.

Industry Insight

Organizations deploying AI-powered document editors must treat embedded content as potential attack surfaces—not just for data leakage but for active code-like behavior within generative contexts. Security teams should advocate for “prompt-aware” document preprocessing layers that strip or flag non-human-readable text before feeding files into LLM systems. Additionally, vendors like Microsoft should implement sandboxed execution environments for Copilot-assisted edits and introduce audit trails tracking instruction inheritance across document versions to detect anomalous replication patterns early.

TL;DR

• Håkon Måløy 发现了一种新型提示注入攻击变种，可将 Microsoft Word 的提示注入升级为自我复制的 AI 蠕虫。
• 攻击者通过在文档中隐藏指令，利用 Copilot for Word 自动执行并传播这些指令，实现跨文档的自我复制与扩散。
• 该攻击无需原始文件存在即可持续传播，是当前首个刻意设计为自我复制的提示注入案例。
• 微软已获知漏洞并给予144天修复期，但至今尚无能覆盖此类攻击全类的缓解方案。
• 此事件揭示了生成式AI工具在办公自动化场景中的深层安全风险，尤其涉及内容生成与编辑流程时。

为什么值得看

本文揭示了一种全新的AI安全威胁范式——基于提示注入的自复制蠕虫，标志着攻击从“单次劫持”向“持续传染”演进，对依赖Copilot等AI辅助工具的办公环境构成实质性风险。对于AI安全从业者、企业IT架构师及开发者而言，这是理解生成式AI在真实工作流中被滥用的关键案例，亟需重新评估输入验证与内容隔离机制。

技术解析

• 攻击核心在于将恶意指令以不可见形式（如白色字体嵌入白色背景）植入Word文档，当该文档作为上下文被Copilot for Word读取时，系统误将其视为用户自然语言请求的一部分。
• Copilot在执行操作（如修改文本、插入段落）后，会将包含隐藏指令的新文档保存下来，使新文档成为下一个感染载体，形成闭环传播链。
• 与传统提示注入不同，本攻击不依赖用户主动交互或外部触发，而是通过AI模型的语义理解与内容生成能力实现自动复制，具备类似生物病毒的特征。
• 目前未发现有效防御手段，常规过滤方法（如关键词检测、格式审查）难以识别隐藏在语义结构中的指令，尤其在多轮编辑和引用场景中更易被忽略。
• 该攻击利用了Copilot对“上下文来源”的信任盲区：未区分原始用户输入与AI生成内容中的潜在指令，导致信任传递失控。

行业启示

• 企业应尽快对使用Copilot等AI办公工具的流程进行安全审计，特别关注文档复用、模板共享与自动编辑功能中的指令暴露风险。
• 开发团队需在AI模型层引入“指令隔离机制”，例如对生成内容进行元数据标记、限制可执行的敏感操作类型，或在输出前扫描潜在恶意模式。
• 安全标准制定机构应将“AI内容传染性”纳入新的风险评估框架，推动建立针对生成式AI系统的动态防护体系，而非仅依赖静态规则匹配。