What caught my eye about Håkon Måløy’s Word worm disclosure is not actually the worm itself. It’s a clever proof-of-concept: hide malicious instructions in white-on-white text, Copilot reads them, copies them into new documents, and the payload spreads. But PoCs are often the least interesting part of the story.
The real story is what it reveals about how Copilot was built. Copilot encounters text in your documents and acts on it. That’s a design choice, one that makes Copilot useful for summarizing, editing, and working with your content. The alternative, a Copilot that ignores instructions it finds in documents, would be much safer, and also much less useful.
So this vulnerability is not a bug. It’s a tension that Microsoft thought they could manage through warnings and user education. They were probably right that most users will never encounter this in the wild. But they were wrong that the vulnerability class can be patched away through simple mitigations.
The disclosure timeline proves it. Microsoft was notified March 6; they had 144 days. They tried blocking the specific prompt. That didn’t work. They tried upgrading the model. That didn’t work either. After two failed attempts, a robust fix for the broader vulnerability class apparently doesn’t exist, or at least not one that keeps Copilot functional as Copilot.
At that point, Måløy’s decision to go public was defensible. The Register’s coverage notes there’s no evidence of real-world exploitation yet; this is still a PoC. But after 144 days of failed patches, you can’t blame a researcher for concluding that public pressure might move the needle where private coordination didn’t.
The harder question is what Microsoft should have done differently. Ship a less capable Copilot that ignores instructions in documents? Redesign the entire product? The right answer probably requires trade-offs that Microsoft decided against. But the worm is less a flaw in the execution than an indictment of the fundamental architecture, one that treats LLM-based assistants and document content as fungible when they shouldn’t be.