TL;DR: An AI worm is a hidden instruction that tricks AI tools into copying it into new emails or documents, spreading without a single click. No real-world attacks have been confirmed, but recent Copilot research means law firms should treat external documents with care and tighten their Microsoft 365 controls.
What is an AI worm?
An AI worm is malicious content that tricks an AI tool into copying and passing it on, much like a computer worm spreading between machines. A traditional worm exploits flaws in software code. An AI worm hides its instructions in ordinary text, which an AI assistant then reads and follows.
Those hidden instructions are known as a prompt injection. When the prompt tells the AI to include a copy of itself in whatever it produces next, researchers call it a self-replicating prompt injection. Each new email or document then becomes a carrier for the next person or AI tool that opens it.
Where did the idea of AI worms come from?
The concept was first demonstrated in 2024 by a small team of security researchers in the US. They named their generative AI worm Morris II, after the Morris worm that disrupted the early internet in 1988.
Morris II targeted AI-powered email assistants built on ChatGPT and Gemini. In a test environment, it stole data and sent spam in a zero-click attack, with nobody clicking a link.
Morris II was never released or found in the wild, but its creators expected generative AI worms to appear within two to three years.
Why are AI worms in the news in 2026?
In September 2026, OpenAI disclosed that its own internal testing had found self-replicating prompt injections in its models. The instructions could spread through an AI agent’s outgoing emails or saved files, although OpenAI stressed no real-world attacks have been recorded.
A few months earlier, a security researcher demonstrated an AI worm inside Microsoft Copilot for Word. The attack hides instructions as white text on a white background in a Word document. When someone asks Copilot to draft or edit using that document, Copilot follows the hidden instructions and copies them into the new file.
That new document then carries the hidden prompt to the next person who uses it. According to Malwarebytes, the attack still worked after Microsoft rolled out several fixes.
In October 2026, Anthropic published research suggesting small AI models could soon spread across poorly secured smart devices, such as cheap Android TV boxes. The experiments ran in controlled conditions, and independent experts say criminals using AI to sharpen their attacks remains the bigger threat today.
How could an AI worm affect your law firm?
Law firms handle a constant flow of documents from outside the business. Counterparty drafts and client attachments arrive every day, and many of them end up as source material for new work.
If your firm uses Microsoft 365 Copilot, those external files become a possible route in. A document carrying a hidden prompt could pass quietly between fee earners, appearing in new drafts that look entirely legitimate.
There is also a precedent for AI tools exposing confidential data. In 2025, a flaw called EchoLeak let a specially crafted email trick Microsoft 365 Copilot into leaking information from a user’s files and chats. Microsoft fixed it before any known misuse. For a firm bound by client confidentiality and SRA obligations, that exposure is a serious concern.
Can prompt injection attacks be stopped?
The UK’s National Cyber Security Centre has warned that prompt injection attacks may never be fully fixed. Large language models cannot reliably tell data apart from instructions. The NCSC advises organisations to focus on reducing the risk and limiting the damage if an attack succeeds.
It also suggests being wary of any vendor claiming to stop prompt injection completely.
How can your firm reduce the risk of AI worms?
You do not need to switch off AI to protect your firm. Start by treating any document from outside your firm as untrusted and checking it before it is used as source material for Copilot.
Copilot-edited drafts should also be read properly before they go to colleagues or clients. One quick check is to select all the text and change the font colour, which reveals anything hidden in white.
Within Microsoft 365, sensitivity labels and data loss prevention let you control what Copilot can access, and Microsoft recommended both following EchoLeak.
Clear AI governance matters just as much. Your team should know which AI tools are approved for client data, and a written AI policy helps reduce shadow AI.
How Labyrinth Technology can help
Labyrinth Technology has supported UK law firms for over a decade, so we understand what is at stake when client confidentiality shapes daily work. We help firms set up Microsoft 365 and Copilot with sensible permissions and data protection policies in place from the start.
Our AI consultancy helps your team use these tools safely. As an ISO 27001 certified provider and one of the few UK MSPs with Assurix verification, security sits at the centre of everything we recommend.
If you would like to review how your firm is using Copilot, book a free consultation with our team.
