Document-borne AI worms can self-propagate through Copilot for Word
Håkon Måløy's coordinated disclosure with Microsoft's MSRC shows that attacker instructions hidden in one Word document get copied into the documents Copilot then generates or edits, turning each of those into a fresh carrier. No executable, no macro — the payload is prose, and the propagation happens inside ordinary document workflows.