Attackers Crash Claude’s ‘Office Party’ Flaw to Run Malicious Code on Linux

Attackers can exploit a flaw in Claude’s document-processing tool by creating a temporary file that Anthropic’s AI assistant can access and run on a user’s machine.

An attacker can use a flaw in Anthropic Claude’s document-processing tool to run malicious code on Linux systems just by creating a temporary file that the AI assistant can access. The flaw highlights a growing risk posed by even trusted AI tools to introduce security gaps in enterprise environments.

Researchers from AIR Security discovered the flaw, which they’ve dubbed “Office Party,” in Anthropic’s official DOCX, PPTX, and XLSX skills, which are tools that enable Claude to create, read, edit, and process Microsoft Word documents, PowerPoint presentations, and Excel spreadsheets, respectively.

The vulnerability stems from a helper script, soffice.py, that launches LibreOffice to convert documents, including rendering Word documents as PDFs, they revealed in a report published today. When the script encounters an environment where Unix-domain sockets cannot be opened, it uses a workaround that loads a shared library through the Linux LD_PRELOAD mechanism.

Anthropic has opted not to fix the issue.

Executing Attacker Code With User Privileges

During conversation, the script checks whether a library named lo_socket_shim.so already exists in a shared temporary directory but does not verify its origin or contents. An attacker who can place a malicious library at that location before the next document-processing operation can potentially have their code loaded and executed within LibreOffice, with the privileges of the user running the AI agent.

In this way, the flaw can allow attackers to execute malicious code on a user’s Linux machine by exploiting an unverified file path used during document conversion, explains Niv Hoffman, co-founder and chief technology officer (CTO) of AIR Research Lab, in an email interview.

“An attacker gets one malicious file into a shared temporary folder which many programs use, and the next time an employee asks Claude for a document, Anthropic’s trusted skill loads that file and runs it,” he tells Dark Reading.

How the Attack on Linux Systems Works via Claude

The vulnerability affects Linux environments where Unix sockets are blocked, including certain container security configurations, and Claude Code’s sandbox. AIR Security reports that macOS is not affected because it does not load the library through LD_PRELOAD.

The AIR researchers demonstrated two ways the attack can work on Linux systems. In one scenario, they manually placed a malicious library in the temporary directory before asking Claude Code to generate a document. In another, they used a separate, seemingly legitimate AI skill to unpack a supporting file into the same directory. When the document-processing skill subsequently ran, the malicious library was loaded automatically.

The flaw presents a serious issue for enterprises running Linux because it exploits “the default skills that all Claude agents use — [of which there are] hundreds of millions — and one planted file can make them run an attacker’s code with the employee’s own access,” Hoffman explains.

This second attack scenario is particularly concerning for enterprise security teams because it illustrates how individually benign-looking AI skills can interact to create an attack chain. And often, “companies don’t have visibility to which skills and other agent add-ons they have installed, and don’t have a red button to revoke or patch a vulnerable one,” Hoffman explains.

Moreover, a malicious or compromised skill does not necessarily need to exploit the document-processing tool directly; it may simply need to place a file that another trusted component will execute, according to the AIR researchers.

Office Party Flaw Remains Unresolved

The AIR team discovered the flaw in May and reported it to Anthropic, which acknowledged its existence, according to the report. However, the AI company “considers it outside its security boundary, since the vulnerable code only runs inside a sandbox,” AIR Research Lab’s Omri Saxena and Or Nevo wrote in the report. This means that as of now, the helper script still uses the same fixed path and still loads whatever file it finds there, they said.

Hoffman says that Anthropic’s response is “not quite” adequate, “because even if the skills run within a sandbox, the attacker’s code then runs inside it with the user’s own permissions, where the user’s files and work already are,” he says. Anthropic did not immediately return Dark Reading’s request for comment about whether the company would take any further action to remedy the issue.

For businesses deploying AI agents and coding assistants, Office Party reinforces the need to treat AI skills as software dependencies rather than trusted extensions, and secure them as such, according to AIR.

To mitigate, organizations should make it a point to know “exactly what skills or add-ons an organization is using with Claude Code by keeping a live inventory of every AI skill and add-on across employees’ agents,” Hoffman says. They also should “review even official ones like any other code, and update or patch the whole set whenever a new vulnerability is published.”