Self-Propagating Prompt Injection (AI Worms)

Indirect injection that reproduces: the payload instructs the assistant both to corrupt the document it is drafting and to copy itself into that output, so every generated document becomes a new carrier and propagation continues without the attacker or the original document. Håkon Måløy's 144-day coordinated MSRC disclosure (Copilot for Word, 2026-07-28, `case-study`) is the first public document-borne instance in a mainstream productivity suite — hidden formatting-concealed instructions in an attached source document alter financial figures and replicate into the draft, with Stage 2 reproducing after the original malicious document is gone; still exploitable at publication after two mitigation attempts, the second a model upgrade to GPT-5.5 that the attack defeated on GPT-5.6 the next day