> Malicious instructions hidden in an externally shared document could make Copilot alter drafted or edited documents in Word and propagate the attack to new documents.
Oh no.
I may be naive here but can the hidden text not be flagged or outright removed before being passed to copilot? Why would there not be consideration for what a human user can see, especially if the hidden text was added by copilot in the first place?
It's VBScript/macro worms all over again!
Could this possible be the first AI worm? Or are there any priors to this?
Why is it possible to have hidden text in a Word document? Why should the AI have access to that text?
It’s the good old white text on white background. Not really a way to defend against this, except having a no-style or high contrast mode that people actually use. Maybe some warning that would trigger if text is too small, off page or has very low contrast would help?
The LLM is reading the bytes of the file, not looking at a picture of its rendering. File metadata exists as well, and change history. Tons of places to hide text.
Even if you processed it via a screenshot, image files are processed byte by byte as well and can contain textual metadata.
The same reason to why you let AI have access to your filesystem. Idiocy, you need to teach AI to be smart somehow.
You train a monkey to learn from a bunch of level intelligence monkeys. The same applies for AI. Just this time we are the monkeys.
@dang I think the author's comment being dead might have been a mistake
“ At the time of publication, no robust mitigation for the broader vulnerability class is available.”
Well, that sounds promising..
Author here.
This post covers a coordinated disclosure with Microsoft (MSRC) regarding a vulnerability class that allows attacker-controlled instructions in an attached document to hijack Copilot for Word.
It manipulates the AI to alter the output text (e.g., halving financial figures) and append the attack prompt into the new document concealed as white text.
Because the downstream document now carries the payload, it acts similarly to an AI worm across normal user workflows. Microsoft deployed multiple fixes over a 144-day coordination period, but the broader vulnerability class remains unmitigated and exploitable because it exploits fundamental limitations of current LLMs.
When attacker instructions are combined with legitimate information the model's context window, the tokens being inspected participate in the act of inspection, meaning current LLM architectures provide no reliable boundary between intention and interpretation.
something something lethal trifecta