Researchers have demonstrated a novel "AI worm" vulnerability within Microsoft Copilot for Word that enables self-propagating prompt injection attacks. The exploit utilizes Cross-Domain Prompt Injection (XPIA) by embedding malicious instructions—often hidden as white text to evade human detection—within an externally shared document. When a user includes this document as context for a Copilot task, the LLM interprets the hidden instructions as authoritative commands rather than untrusted data. In successful proofs-of-concept, Copilot was manipulated to perform unauthorized actions, such as halving numerical values in financial reports, and subsequently copying the malicious prompt into the newly generated or edited document. This creates a new carrier that can spread the attack through internal workflows, even after the original malicious file is removed from the context. Despite a 144-day coordinated disclosure period and multiple mitigation attempts by Microsoft—including model upgrades to GPT-5.5 and GPT-5.6—testing confirmed that the underlying vulnerability class remains exploitable. The attack can be triggered via the "Edit with Copilot" feature or by allowing Copilot to search OneDrive for relevant files, making it a significant threat to the informational integrity of collaborative enterprise environments.