Context Collapse, Part 3

ID: 2823386c
原文链接: https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/
作者: Håkon Måløy
发布时间: 2026-07-28
抓取时间: 2026-07-30

中文导读

与 MSRC 协调披露 144 天后公开：攻击者把白字隐藏 JSON 指令藏进外部共享文档；受害者用 Copilot 起草或编辑时，模型改写财务数字并把指令复制到下游文档，形成可在组织内部传播的文档载体蠆虫。现有缓解含模型升级仍未关闭这一类问题。

为什么值得关注

Word Copilot 会读附件隐藏指令、改报表数字，并自我复制到内部文档——文档载体蠆虫

原文摘录

发布时间: 2026-07-28T14:00:00+02:00

原文链接: https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/

Context Collapse, Part 3 - AI Worming through Word

Contents

I would like to thank Microsoft product teams and Microsoft Security Response Center (MSRC) for collaborating with me on this technical analysis and mitigation of the disclosed vulnerabilities. The editorial opinions reflected below are solely the author’s and do not necessarily reflect those of the organizations I collaborated with.

Summary#summary

The findings described in this post are part of a coordinated disclosure with MSRC and Microsoft product teams. Microsoft was provided with reproduction steps, videos, environmental assumptions, and the exact proof-of-concept (PoC) prompts used during testing. They were also informed of a 90-day coordination period before disclosure. This was extended two times, resulting a 144-day coordination period.

In parts 1 and 2 in this series, I have shown how external inputs could influence Copilot responses and, in some cases, potentially lead to confidentiality impacts through Cross-Domain Prompt Injection Attacks (XPIAs). This report builds on those findings and extends the XPIA analysis from single-interaction compromise to propagation across trusted document workflows. It shows that attacker-controlled instructions in one document can be copied into Copilot-generated or Copilot-edited Word documents, causing those downstream documents to become new carriers of the same attack.

Previous examples of AI-worms exist. Notably, Morris II demonstrated self-replicating prompt propagation in GenAI-powered email-assistant ecosystems. However, to my knowledge, this is among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite.

The reported scenario is:

1. Malicious instructions hidden in an externally shared document could make Copilot alter drafted or edited documents in Word and propagate the attack to new documents.

The full attack in brief#the-full-attack-in-brief

The attack#the-attack

An attacker places hidden instructions in a document that is later used as source material in Copilot for Word. Copilot may interpret those instructions as part of the user’s request, causing it to manipulate the document being drafted or edited. Copilot may then also copy the hidden instructions into the resulting document, turning that document into a new carrier. If the carrier is subsequently used in another Copilot-assisted workflow, the instructions can trigger again and propagate into further documents, even without the attacker’s original document being present.

Example#example

Consider an employee preparing a financial report. The employee downloads a market analysis from a trusted website that has been compromised, unaware that the document contains hidden instructions. The employee then includes the analysis as source material when drafting the report with Copilot. The hidden instructions cause Copilot to alter internal figures in the financial report and copy the attack into the new document. The employee saves and shares the apparently legitimate report internally. Later, a colleague uses it as source material for another report; the instructions trigger again, alter the new report, and copy themselves forward. The attack can therefore continue without further involvement from either the compromised website or the original malicious document. As affected reports are reused, additional reports and documents can become carriers of the attack.

Disclosure status at publication#disclosure-status-at-publication

1. Treating externally sourced documents as untrusted when used with Copilot. 2. Reviewing any attached document before starting a Copilot generation or edit. 3. Carefully reviewing Copilot-generated or Copilot-edited documents before reusing, sharing, or distributing them.

Vendor: Microsoft
Coordinated disclosure: Handled through MSRC and Microsoft product teams
Included in this post: XPIA and self-propagation scenario in Microsoft Copilot for Word
Customer action: No customer-side remediation fully addresses the issue at the time of publication. Customers can reduce exposure by:
Microsoft-side status: Testing has reproduced the attack with all current mitigations deployed. At the time of publication, no robust mitigation for the broader vulnerability class is available.

A note on disclosing before a fix#a-note-on-disclosing-before-a-fix

Unlike Parts 1 and 2, this scenario remains exploitable at publication. I have weighed that carefully. The coordination period agreed with Microsoft has been exhausted, and testing shows that no robust mitigation for the broader vulnerability class is currently available. Two mitigation attempts, including a model upgrade, did not close the class.

I have therefore chosen to disclose at the class level rather than the payload level. My reasoning is that defenders cannot reduce exposure to a risk they are unaware of, and the propagation mechanism described here affects ordinary document workflows that many organizations already rely on. Withholding the existence of the issue would leave those organizations unable to make an informed decision, while providing no additional protection.

Disclosure timeline#disclosure-timeline

2026-03-06: Initial report submitted to MSRC with reproduction steps, videos, environmental assumptions, and PoC prompts.
2026-03-09: MSRC acknowledged receipt and opened a case.

[... 原文已截断，完整内容见链接 ...]