Canopy9560

That is correct. Really, the only "new" thing is the propagation part

Microsoft, and MSRC in particular, have been hands-on and very responsive from the get-go. I think this problem is better viewed as a current LLM technology problem in general. Several mitigations have already been implemented that dramatically reduce the attack surface and propagation frequency. However, in general I think this is a real problem with no real solution yet.

Morris II(https://arxiv.org/abs/2403.02817) did demonstrate worming behaviour, so the concept at least is not new. However, I do not know of any similar demonstration in a commercial productivity product like Word.

Author here.

This post covers a coordinated disclosure with Microsoft (MSRC) regarding a vulnerability class that allows attacker-controlled instructions in an attached document to hijack Copilot for Word.

It manipulates the AI to alter the output text (e.g., halving financial figures) and append the attack prompt into the new document concealed as white text.

Because the downstream document now carries the payload, it acts similarly to an AI worm across normal user workflows. Microsoft deployed multiple fixes over a 144-day coordination period, but the broader vulnerability class remains unmitigated and exploitable because it exploits fundamental limitations of current LLMs.

When attacker instructions are combined with legitimate information the model's context window, the tokens being inspected participate in the act of inspection, meaning current LLM architectures provide no reliable boundary between intention and interpretation.