AIR Security Finds Claude Flaw That Runs Malicious Code on Linux

Researchers from AIR Security have exposed a vulnerability in Anthropic Claude’s document-processing capabilities, nicknamed “Office Party,” which can enable attackers to run malicious code on Linux systems by simply creating a temporary file accessible to Claude. The flaw exists in Claude’s DOCX, PPTX and XLSX processing workflows, which rely on a helper script, soffice.py, to launch LibreOffice for document conversion.

When a Unix-domain socket cannot be opened, the script uses a LD_PRELOAD workaround that loads a shared library, creating a potential loading point for attacker-controlled code.

The researchers demonstrated two attack paths. In one, a malicious library placed in a shared temporary directory before a document-generation operation is loaded by Claude Code and executed with the user’s privileges. In another scenario, a separate legitimate-looking AI skill can unpack a malicious file into the same directory, after which the document-processing step loads and runs it.

The attack exploits an unverified path for the lo_socket_shim.so library, meaning code placed in the directory could be executed within LibreOffice under the employee’s account. AIR notes that macOS is not affected because it does not load the library via LD_PRELOAD, and that the vulnerability can be triggered in Linux environments with blocked Unix sockets or certain container security configurations.

Anthropic has opted not to fix the issue, with AIR warning that even sandboxed skills can allow attacker code to run with the user’s permissions. The report urges organisations using Claude to treat AI skills as software dependencies and maintain live inventories of all skills and add-ons, including official ones, and to review and patch them as new vulnerabilities are disclosed.