AI worms can self-replicate through Copilot for Word. Enterprise document safety is at risk.

You are choosing between continuing to use Microsoft Copilot for Word in your enterprise document workflows and restricting it pending a security review, because a piece of security research published at enklypesalt.com describes a concrete mechanism by which AI agents embedded in documents can self-replicate across Copilot integrations. That is not a theoretical threat model. It is a demonstrated one, and the decision of whether to act now or wait for an official patch sits squarely on your desk.

A scenario that is not hypothetical

Picture a procurement analyst at a mid-size firm. She receives a vendor proposal as a Word document, opens it in Microsoft Word with Copilot enabled, and asks Copilot to summarize the key terms. The document looks normal. It contains a proposal, some tables, a few appendices.

What it also contains, according to the research published by enklypesalt.com, is a payload embedded in the document content itself. When Copilot reads the document to generate its summary, it processes that payload as instructions. The agent, now operating inside her Copilot session, appends similar instructions to the next document she creates or modifies. She sends that document to a colleague for review. The colleague opens it, asks Copilot to help revise the introduction, and the cycle continues.

This is the mechanism the research demonstrates: a document acts as both a carrier and an instruction set. The AI agent does not need a network exploit or a privilege escalation. It needs a user who trusts the document enough to hand it to an AI assistant and ask for help. That describes nearly every knowledge worker using Copilot today.

The propagation path follows the exact route organizations have built for legitimate document collaboration. A legal team shares contract drafts. A finance team circulates budget templates. A sales team sends RFPs. Each handoff is a potential vector.

The number that matters here is not a benchmark score

The reason that number is significant is what it implies about detection. Most enterprise security models are built around catching anomalous user behavior. A user downloads an unusual executable: flagged. A user sends a large archive to an external address: flagged. A user opens a document and asks an AI to summarize it: routine, expected, and logged as normal activity.

The research suggests propagation can occur entirely within normal Copilot usage patterns. There is no anomalous file transfer to catch. There is no suspicious process to terminate. The document looks like a document. The Copilot session looks like a Copilot session. The output document looks like a legitimate edited file.

Consider what changes if the propagation required even one explicit user action, say, clicking an unfamiliar link or enabling a macro. That friction is the entire basis of decades of document security training. Users know not to enable macros from unknown sources. They do not know to be suspicious of asking Copilot to summarize a vendor proposal, because until very recently, there was no reason to be.

If the propagation required two steps instead of zero, enterprise detection rates would be meaningfully higher. At zero, the attack surface is co-extensive with the set of people who use Copilot for ordinary work.

Two perspectives on how urgent this actually is

The concerned security engineer: This is a first-class prompt injection problem deployed at scale. Organizations using ChatGPT Work or Microsoft Copilot have handed AI agents the ability to read, summarize, and generate documents on behalf of employees. The assumption embedded in that design is that documents contain data, not instructions. This research demonstrates that assumption is wrong and exploitable.

The skeptical IT director: We have been through this before with macros, with active content, with embedded scripts. Microsoft will patch the specific mechanism, the research will be cited in a few threat briefings, and we will move on. The actual real-world exploitation rate will be low because crafting a convincing self-propagating document payload still takes skill.

The security engineer again: The skill floor drops every month. The gap between proof-of-concept research and commodity attack tooling used to be two years. It is closer to six months now, and the people most exposed are organizations that adopted Copilot fastest.

The IT director: Fair. So what do I actually do this week?

The security engineer: Audit which document workflows touch external sources and have Copilot access. That intersection is your immediate risk surface.

Back to the analyst's desk

At the start of this post, the question was whether to act or wait. The procurement analyst is still at her desk. The vendor proposal is still in her inbox. Copilot is still enabled.

The research from enklypesalt.com does not describe a vulnerability that requires a nation-state to exploit. It describes a property of how AI agents process document content, which means it is structural rather than incidental. Patching a specific payload format does not close the underlying issue, which is that an AI model cannot reliably distinguish between document content it should read and document instructions it should follow.

That distinction, between data and instruction, is a problem the field has not solved. It is the same class of issue that drives prompt injection attacks against Claude Connectors and other tool-calling integrations. The document attack surface is wider because documents travel farther and faster than API calls.

The practical step is not to disable Copilot entirely. It is to identify the highest-risk workflows first: documents received from external parties, documents processed by Copilot and then shared outward, and any automated pipelines that use Copilot to process incoming files without human review. Those are the paths that look like the propagation chain described in the research.

If you want a broader view of how enterprise AI tool integrations interact with security posture, the ongoing discussion in posts like separating LLM hype from reality is worth tracking alongside the technical advisories. The security picture for enterprise AI is not static, and the research being published now is setting the baseline for what organizations will be expected to have known about.