Håkon Måløy发现了一种能自我复制的提示注入攻击，专门针对Word里的Copilot，会把隐藏指令传染给后续文档，微软还没完全修好。安全从业者可以看看这种新变种。
安全研究员Håkon Måløy发现一种针对Microsoft Word Copilot的提示注入攻击变种，攻击者可在文档中嵌入隐藏指令，当Copilot处理该文档时，指令会操纵新文档并复制自身，形成自复制蠕虫。微软在负责任披露后获得144天修复期，但目前尚无全面缓解措施。此攻击利用Copilot对用户请求的解读机制，使恶意指令在不依赖原始文档的情况下持续传播。
AI Worming through Word
AI Worming through Word Neat new prompt injection variant by Håkon Måløy, who found a way to upgrade prompt injection attacks against Microsoft Word to full self-replicating worms: An attacker places hidden instructions in a document that is later used as source material in Copilot for Word. Copilot may interpret those instructions as part of the user’s request, causing it to manipulate the document being drafted or edited. Copilot may then also copy the hidden instructions into the resulting document, turning that document into a new carrier. If the carrier is subsequently used in another Copilot-assisted workflow, the instructions can trigger again and propagate into further documents, even without the attacker’s original document being present. We've seen plenty of hidden white-on-white text before - the kids are using it in their job applications now - but this is the first one I've seen that deliberately copies instructions to self-replicate itself. It was responsibly disclosed to Microsoft who then had 144 days to work on a fix, but so far (unsurprisingly) there's no mitigation that covers the full class of attack. Via Hacker News Tags: microsoft , security , ai , prompt-injection , generative-ai , llms