Well, that sounds promising..
This is one of the reasons it would be completely insane to give LLMs access to your data or rely on them for important tasks. But apparently that doesn't stop people from doing it anyway.
Oh no.
And I thought people understood that.
You train a monkey to learn from a bunch of lower level intelligence monkeys. The same applies for AI. Just this time we are the monkeys.
Even if you processed it via a screenshot, image files are processed byte by byte as well and can contain textual metadata.
As long as Copilot can't be prevented from acting on instructions in its input, it would be safer to not make untrusted document content part of the input, similar to how macros in untrusted documents aren't executed by default.
In the past, a worm couldn't really evolve unless it was coded to do so, and only to the extent it was coded. But an LLM worm, which instructs the LLM to copy the instructions elsewhere, will have slight random changes made as different LLMs will not always copy it perfectly. If a counter measure is deployed, and one of this alterations allows a miscopy to survive and keeps spreading, it feels like we have hit a much more natural case of evolution of a worm than ever before.
One might even argue it is the most natural case of evolution in software because the evolution was never intentionally designed. The worm wasn't made to evolve, the LLM wasn't made with the idea of helping the worm evolve, the task trying to end the worm was done with the intent of the worm evolving. While all steps are human done, evolution wasn't intended by any of them, so if it does happen, it makes it a bit more 'natural' than every simulated evolution algorithm before it.
It is fun to see how all AI narratives are collapsing.
Purged I would have
All things Microsoft from my (controllable) world
Paste any document in any LLM and you'll risk that, it's not something Microsoft specific.
There are many approaches today. Check out https://tritium.legal/blog/noroboto where we tricked frontier algorithms into reading different Unicode values from those presented by the fonts in the document.
function Greeting({ name }) { return <h1>Hello, {name}</h1>; }
Could it be that the whole idea is silly misunderstanding of fundamental tenets of reality in the first place?
People get too hung up on this fundamentally wrong idea, and the space of security, instead of progressing, is just running in circles like a headless chicken, making a mess of everything.
- Erroneous information left in plain sight in an externally shared document could make Copilot - or any other agentic system, including LLMs and protein-based intelligence, alter drafted or edited documents in Word (or any other program, or with pen and paper) and propagate the errors to new documents.
In other news:
- Many humans still believe in silly superstitions like flat Earth or that code and data are fundamentally distinct, or that control vs. data plane is anything more than a design opinion that doesn't apply to the universe in general.
Word has a feature literally called "hidden text". Select some text, go to the font properties dialog, click "hidden" and OK, and watch the text disappear.
I believe you would see hidden text by default (but this was a long time ago and I may have misremembered) when in "normal mode" (later "draft mode" and now removed entirely), which was the default view and showed a long continuous stream of text without the computation expense of calculating page break locations. But when you switch to "print layout mode" (now the usual view unless you're in reading mode) it would be hidden, so you could see what the document would be like printed, unless you explicitly turned on the display of hidden text in that mode.
What AI tools really need is reliable power-user levels of awareness about Word features, and corresponding structured access.
Canopy9560•1h ago
This post covers a coordinated disclosure with Microsoft (MSRC) regarding a vulnerability class that allows attacker-controlled instructions in an attached document to hijack Copilot for Word.
It manipulates the AI to alter the output text (e.g., halving financial figures) and append the attack prompt into the new document concealed as white text.
Because the downstream document now carries the payload, it acts similarly to an AI worm across normal user workflows. Microsoft deployed multiple fixes over a 144-day coordination period, but the broader vulnerability class remains unmitigated and exploitable because it exploits fundamental limitations of current LLMs.
When attacker instructions are combined with legitimate information the model's context window, the tokens being inspected participate in the act of inspection, meaning current LLM architectures provide no reliable boundary between intention and interpretation.