Copilot Just Became the Attack Surface

Microsoft’s AI integration strategy has a worm problem.

Researchers at Enklypesalt just published a working demonstration of AI worms self-propagating through Copilot for Word. Open a document, the worm infects your Copilot context, Copilot generates new documents with the payload baked in, those documents infect the next person who opens them. The attack surface isn’t a server vulnerability or a credential leak. It’s the AI assistant you’ve been told to trust with your entire document workflow.

This isn’t a hypothetical. It’s a repeating pattern. Every time a major platform embeds an AI agent into a high-trust context — your email, your IDE, your word processor — it opens a new class of injection attacks. The document becomes the malware. The assistant becomes the vector. And the user, who was promised a productivity multiplier, is now the unwitting carrier.

There’s a companion paper worth reading alongside this. Handbook.md ran systematic tests on whether long policy documents reliably govern agent behavior. The short answer: they don’t. You can write a thousand-word system prompt telling an AI agent exactly what it should and shouldn’t do, and the agent will still behave inconsistently under adversarial conditions. The policy is not the control. The policy is a suggestion. This matters because the entire enterprise defense strategy for AI assistants is currently “write better instructions.” That strategy is insufficient against a motivated attacker who simply includes malicious instructions inside a document the agent is told to process.

Put these two findings together and you get a genuinely uncomfortable picture. Microsoft has deployed Copilot inside Word to hundreds of millions of enterprise users. Those users trust Word documents the same way they trust email — imperfectly but habitually. They open documents from clients, vendors, partners, and strangers. The attack vector doesn’t require sophisticated social engineering. It requires an adversary who understands that the document is now executable.

Everyone says the AI security problem is about model misalignment — some future superintelligent system deciding to pursue unintended goals. The opposite is closer to true right now. The near-term AI security problem is boring, old-fashioned prompt injection dressed up in a new attack surface. The model is doing exactly what it’s told. The problem is that the attacker is the one doing the telling.

Microsoft is not oblivious to this. Their security team is not incompetent. But there’s a structural tension here that doesn’t resolve with a patch. Deep Copilot integration is the entire product thesis — the reason Microsoft invested $13 billion into OpenAI was to make every Microsoft product smarter by embedding AI agents into the workflow. Rolling that back, or sandboxing it aggressively enough to block these attacks, means dismantling the very feature that’s supposed to justify Copilot’s enterprise pricing. This is what institutional lock-in looks like from the inside: the feature is the vulnerability.

Supply chain attacks on npm and GitHub Actions — also in the news today — follow the same logic. GitHub’s security team published their disruption work, which is real and meaningful. But the attack surface keeps expanding because every new integration, every new hook into the developer workflow, is a new injection point. GitHub Copilot, npm packages, GitHub Actions: these aren’t separate products. They’re a single trust chain, and the chain is only as strong as its most manipulable link.

The security industry will respond by building AI-powered defenses against AI-powered attacks. That’s already happening — see the “bullshit detector” agent tools also making rounds today. More agents, watching agents, watching agents. This is the road we’re on. It is not obviously a stable road.

The stakes are concrete: enterprise Copilot penetration is already at scale, the attack technique is published and reproducible, and the defensive posture — “write better system prompts” — is empirically insufficient. The window between proof-of-concept and active exploitation in the wild is measured in weeks, not years.

You can’t bolt document-level security onto an AI assistant that was designed to trust documents. The architecture is the vulnerability.