A researcher just demonstrated a zero-click "AI Worm" that moves through Microsoft Word documents via Copilot. Here is the terrifying attack chain: You open a document with hidden, white-on-white text containing a prompt injection. Copilot reads it, believes the hidden text is a legitimate instruction from you, and quietly alters the financial figures in your report. Copilot then copies the malicious prompt into the new document to infect the next user.

Microsoft knew about this for 144 days. Their fix? Updating the model. Guess what? The attack still works.

Stop trying to fix semantic intent with better models. If you are handing an AI agent the keys to your filesystem, your OneDrive, or your CRM, you cannot rely on the LLM to grade its own homework. A poisoned context window bypasses every "guardrail" you prompt it with.

We are entering the "Wild West" of Agentic execution. We need to stop treating security like a content moderation problem ("Please don't be bad") and start treating it like a Distributed Systems problem. You need a layer outside the model to govern intent.

Imagine an architecture where an agent trying to silently alter and exfiltrate financial data triggers an external "Jury" of smaller models. They pause the execution, reach consensus that the intent is malicious, and kill the session. If you aren't inspecting the semantic traffic before execution, you aren't securing your agents. You are just hoping they behave.

Source article:
Read the report on The Hacker News →