Document Worms Are the Agent Security Problem Nobody Budgeted For
Document Worms Are the Agent Security Problem Nobody Budgeted For
A July 2026 disclosure showed how hidden instructions in one document can make an AI assistant alter a new document and copy the attack forward. That turns ordinary business drafts into carriers.
The next major agent security failure may not look like malware. It may look like a spreadsheet summary, a quarterly business review, or a policy draft that a trusted employee created with an AI assistant.
On July 28, 2026, researcher Hakon Maloy published the third part of his Context Collapse series: AI Worming through Word. The coordinated disclosure described a Microsoft 365 Copilot for Word scenario where attacker-controlled instructions hidden in a source document could influence a new draft, alter its contents, and then copy the hidden instructions into the new document. That downstream document could later trigger the same behavior again, even without the original malicious file.
That is the part security leaders should sit with. The attack is not only “prompt injection in a document”. It is propagation through trusted business workflows.
What Happened
The proof of concept used hidden natural-language instructions in a Word document. The text could be concealed with formatting such as white text on a white background and a small font size. Humans may not notice it. The assistant still can, because the document content is normalized before it enters the model context.
When the malicious document was used as source material for a new Copilot-assisted draft, the assistant could follow two attacker goals:
- Change the generated document, such as altering financial figures.
- Copy the hidden instruction into the generated document, making the new document a carrier.
The researcher reported the behavior through MSRC on March 6, 2026. The disclosure period ran 144 days. Microsoft shipped mitigations, including a model upgrade on July 14, but the researcher reported that modified payloads still reproduced the broader attack class by July 28.
Source documents are data. User intent is authority. In this class of attack, both enter the same context and the model is asked to separate them after attacker-controlled text has already shaped the computation.
The Worm Does Not Need Code Execution
Most enterprise security programs still categorize document risk around macros, embedded objects, file exploit chains, and known malicious attachments. This is different.
The attack uses the assistant’s normal job:
No shell. No macro prompt. No executable attachment. The exploit rides on a trusted assistant performing a trusted workflow over untrusted content.
That is why this class matters for CISOs. Your data loss prevention tools may watch for secrets leaving the company. Your endpoint stack may watch for suspicious processes. But this attack targets something more subtle: the integrity of the documents your organization uses to make decisions.
Why This Is Not Just “Prompt Injection”
Calling this prompt injection is technically accurate and strategically insufficient.
Prompt injection usually makes teams think about a single interaction: the model sees hostile text, produces a bad output, and the user catches it or does not. Document worming changes the failure mode from a bad answer to a contaminated workflow.
| Old mental model | Document-worm model | Security implication |
|---|---|---|
| The malicious file is the risky object. | The AI-generated derivative becomes risky too. | Trust cannot be inherited from internal authorship alone. |
| Review the output before sharing it. | The visible output can look normal while hidden instructions persist. | Review must include provenance, invisible content, and AI edit history. |
| Block known payloads. | Modified wording can preserve the same intent. | Controls need intent isolation, not just pattern matching. |
| The incident starts with an outside attacker. | The next carrier may come from a trusted partner or coworker. | Collaboration boundaries become agent security boundaries. |
The architectural issue is context collapse: content, evidence, instructions, memory, and user goals are compressed into one reasoning space. The assistant has to inspect untrusted material to decide whether it is safe, but the inspection itself is performed inside the same model context the attacker is trying to influence.
The OWASP Agentic Top 10 Lens
The OWASP Top 10 for Agentic Applications 2026 is the right framework because it focuses on agents that plan, act, use tools, and make decisions across workflows. This incident class maps across several categories:
ASI01: Agent Goal Hijack
The user’s goal is to draft or edit a business document. The hidden source text injects a competing goal that changes what the assistant does.
ASI06: Memory and Context Poisoning
The attack persists by embedding itself in downstream context. The carrier is not a model memory store, but it behaves like one.
ASI09: Human-Agent Trust Exploitation
Employees trust internally generated files and polished assistant output. The attack uses that trust to move between teams.
You can also read parts of this through ASI02 if the assistant has document manipulation authority, and ASI08 if contaminated documents trigger cascading operational decisions. The main point is that the risk is not contained by saying “the model was fooled”. The organization delegated workflow authority to the model.
The Control That Is Missing: Provenance
The researcher recommended provenance metadata for generated documents: what source material was used, what the model changed, and whether hidden or abnormal content was carried forward. That will not prevent every attack, but it changes response from guesswork to investigation.
Security teams should push for four controls:
Controls to ask for this quarter
- Instruction isolation: source documents can provide facts, not task authority.
- Hidden-content inspection: flag invisible text, tiny text, off-page content, suspicious metadata, and formatting-normalized deltas before AI use.
- AI edit provenance: record source files, generated sections, transformations, and model-applied edits in tamper-evident metadata.
- Derivative quarantine: documents generated from external sources should carry a trust label until reviewed for hidden instructions and material changes.
- Workflow-level red teaming: test document creation, revision, sharing, and reuse as a chain, not as isolated prompts.
The uncomfortable answer is that model upgrades and payload filters are necessary but not sufficient. They can reduce known attacks. They do not create a durable separation between instruction and evidence.
What To Ask In The Next Vendor Review
If your organization uses AI assistants inside office documents, knowledge bases, tickets, or contract workflows, ask direct questions:
- Can untrusted source material ever change the assistant’s task instructions?
- Does the product preserve provenance for every source used in a generated file?
- Are hidden or visually suppressed instructions visible in the review UI?
- Can AI-generated derivative documents be labeled, quarantined, or restricted by policy?
- Does the assistant treat internal documents created from external sources as lower trust?
- Are prompt-injection mitigations tested across multi-document, multi-step workflows?
If the answers are vague, assume the system is optimizing for productivity first and integrity second.
Bottom Line
Document-borne AI worms are a warning about where enterprise AI risk is going. The attacker does not need to compromise the endpoint if the assistant will faithfully carry hostile instructions into the next trusted artifact. The malware is not a binary. The persistence layer is the business process.
Security teams should stop treating AI-generated documents as clean internal content by default. In agentic systems, every derivative artifact needs a history, a trust label, and a way to prove which instructions shaped it.
Sources
- Hakon Maloy, Context Collapse, Part 3 - AI Worming through Word, July 28, 2026.
- TechRadar, Expert warns this dangerous Microsoft Word worm can burrow into Copilot and cause havoc, August 1, 2026.
- OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications for 2026, December 9, 2025.