Copilot 웜이 Word 문서로 확산…Microsoft, 두 번의 수정 실패
연구원 Håkon Måløy는 Word 문서에 숨어드는 Microsoft Copilot용 자가 확산 웜을 만들었습니다. 두 번의 수정 시도가 실패한 후 144일간 노출되며, 프롬프트 인젝션이 얼마나 패치하기 어려운지 보여줍니다.
security researcher håkon måløy created a self-spreading worm targeting microsoft copilot by hiding instructions in white text within word documents; when copilot processes the file, it executes the hidden commands and copies them into new documents, creating a chain of infection. microsoft acknowledged the flaw on march 31 and attempted two fixes that failed, leaving the vulnerability active for 144 days without a patch. the attack vector specifically risks enterprises that rely on copilot for data processing, as a single compromised file from the internet could manipulate internal reports and spread across the network. the existence of this worm validates industry concerns that prompt injection is a critical, unsolved security problem for generative ai adoption.