Top
Best
New

Posted by Canopy9560 11 hours ago

Document-borne AI worms can self-propagate through Copilot for Word(enklypesalt.com)
317 points | 238 commentspage 4
westurner 10 hours ago|
Yesterday I was reading model thinking output and learned that the model has concerns about shell backticks in commit messages.
igregoryca 9 hours ago||
That's what thinking output is for, right? Mixing random tokens that live roughly in the same semantic realm, throwing them at the wall, and seeing what sticks? Hopefully, this backticks concern didn't stick.
westurner 9 hours ago||
I thought this was ironic because there's no good way to actually restrict which commands the AI runs save for sandboxing; and here it was expressing concern about OS command injection in the git commit message string argument to git. How to not use the equivalent of what subprocess calls (shell=True) which does exec code in backticks?

Would single quotes solve this

Which types of documents have this particular AI vulnerability?

josefritzishere 10 hours ago||
It's increasingly clear that AI needs to be heavily regulated to be safe for public use. It needs to grow out of it's "wild west" model.
Terr_ 4 hours ago||
No, make corporations actually liable/responsible for their harmful choices in pursuit of quarterly profits, and then they'll stop using the technology badly.
watwut 9 hours ago||
This has nothing to do with "model" being unsafe or too powerful or whatever else excuse Antropic wants to use to ban competition.

This is equivalent of sql injection and normal worm.

TeMPOraL 1 hour ago||
Security aspect is honestly a non-story here.

The same process happens in the perfectly "secure" case of errors in text. They propagate. People pay way too little attention to that, even though unlike security stories, this affects many if not most LLM users at this point.

anthk 8 hours ago||
Text processing formats should be declarative and not Turing complete. And, yes, leave PDF and PostScript for printers and final output, please.
Canopy9560 11 hours ago||
Author here.

This post covers a coordinated disclosure with Microsoft (MSRC) regarding a vulnerability class that allows attacker-controlled instructions in an attached document to hijack Copilot for Word.

It manipulates the AI to alter the output text (e.g., halving financial figures) and append the attack prompt into the new document concealed as white text.

Because the downstream document now carries the payload, it acts similarly to an AI worm across normal user workflows. Microsoft deployed multiple fixes over a 144-day coordination period, but the broader vulnerability class remains unmitigated and exploitable because it exploits fundamental limitations of current LLMs.

When attacker instructions are combined with legitimate information the model's context window, the tokens being inspected participate in the act of inspection, meaning current LLM architectures provide no reliable boundary between intention and interpretation.

SnipeOfficial 7 hours ago||
[flagged]
nttylock 4 hours ago||
[flagged]
KolibriFly 10 hours ago|
[flagged]