The case concerns a reported prompt-injection technique in which hidden instructions embedded in documents processed by Microsoft Copilot for Word may cause agentic behavior to propagate through additional documents or users. The supplied snippets establish that Microsoft 365 Copilot processes potentially hostile file or email content, exposes an `XPIADetected` signal for cross-prompt injection, and has faced related attacks that bypass initial safeguards through follow-up instructions. However, they do not independently establish the claimed self-propagating Word worm, its behavior across realistic users, the identity of its researcher, or Microsoft/MSRC’s response, so those details remain based on the case’s thin disclosure summary.
No Scott wiki or radar intersection was found; the supplied material does not establish that this claim bears on a position, project, or tracked case of his.
queries asked of Scott's wikis
- indirect prompt injection through documents and RAG
- self-propagating agent actions and AI worms
- trust boundaries for agent-generated documents
- product-level containment for prompt injection
- tainted-content tracking across agent workflows
- Microsoft 365 Copilot security and document automation
2026-08-07T17:48:00Z
After 48 hours, the case remains a single-researcher disclosure with no independent reproduction, Microsoft response, or evidence of realistic cross-user propagation. Engagement-only amplification has faded without the substantive follow-up needed to keep the episode active.
2026-07-30T02:21:54Z
The attachment still resolves to the original disclosure and adds no independent reproduction, Microsoft response, or realistic cross-user propagation evidence. Further engagement churn does not change the case; revisit only on substantive technical or product-level follow-up.
2026-07-30T01:22:57Z
The newly attached evidence still traces to the original disclosure and adds no independent reproduction, Microsoft response, or realistic cross-user propagation evidence. Treat further engagement-only churn as repetitive amplification and wait for technical or product-level follow-up.
2026-07-30T00:24:49Z
The attachment still resolves to the original researcher’s disclosure and adds no independent reproduction, Microsoft response, or realistic cross-user propagation evidence. Engagement-only churn no longer warrants frequent review; wait for a technical replication or product-level action.
2026-07-29T23:25:29Z
The newly attached material still adds no independent replication, Microsoft confirmation, or realistic cross-user propagation evidence; it remains the original disclosure plus repetitive HN amplification. Further engagement-only updates should not trigger close review without a technical reproduction or product response.
2026-07-29T22:28:11Z
The evidence still consists of the original researcher’s disclosure plus repetitive HN amplification; there is no independent replication, Microsoft confirmation, or realistic cross-user propagation evidence. The case remains dormant pending substantive technical or product-level follow-up.
2026-07-29T21:25:50Z
The attached evidence still resolves to the original researcher’s disclosure and adds no independent replication, Microsoft confirmation, or realistic cross-user propagation evidence. HN engagement remains repetitive amplification rather than a change in the case’s meaning.
2026-07-29T20:26:11Z
The attached evidence still adds no independent replication, Microsoft confirmation, or realistic cross-user propagation evidence. The case remains a plausible single-researcher disclosure whose continued HN discussion is repetitive amplification rather than substantive corroboration.
2026-07-29T19:28:29Z
The attached evidence still traces to the original disclosure and adds no independent replication, Microsoft confirmation, or realistic cross-user propagation. Continued HN attention is repetitive amplification, so the case remains dormant pending substantive follow-up.
2026-07-29T18:26:45Z
The newly attached material still traces to the original researcher’s account; claimed MSRC coordination is not Microsoft confirmation or independent replication. HN discussion remains amplification without realistic cross-user propagation evidence or a product response.
2026-07-29T17:27:45Z
The attached material still resolves only to the original researcher’s disclosure; HN attention provides no independent replication, Microsoft confirmation, or realistic cross-user propagation evidence. Repeated engagement updates are amplification rather than a change in meaning.
2026-07-29T16:30:14Z
Updated HN engagement only; no independent replication, no MSRC confirmation, no additional evidence. Meaning unchanged since first grounding.
2026-07-29T15:31:56Z
The attached disclosure adds no independent replication, Microsoft confirmation, or evidence of propagation across realistic users. Discussion remains amplification of a plausible but single-source product-security claim, so its meaning is unchanged.
2026-07-29T14:29:17Z
No new independent evidence or MSRC confirmation since creation. The HN discussion remains speculative amplification of the single-source disclosure. Case is dormant — no replication, no product-level response, no Scott relevance.
2026-07-29T13:27:38Z
Modest engagement increase on HN but no independent replication or MSRC confirmation; case remains a single-source disclosure.
2026-07-29T12:26:22Z
grounded: novel/none — No Scott wiki or radar intersection was found; the supplied material does not establish that this claim bears on a position, project, or tracked case of his.
2026-07-29T12:25:31Z
origin walked (codex/luna, conf 0.98): anchor hn.story.49096188 -> echo.blog.b28412bb01 by Håkon Måløy
2026-07-29T12:24:37Z
case created — Single HN story with moderate discussion but no independent replication yet.