AIR Security reports Claude Office Party flaw enabling Linux code execution
AIR Security says Claude document skills on Linux load an unverified library from a temp folder; Anthropic has not fixed it, so inventory skills.
- Published
- Exploitation
- No. No in-the-wild exploitation is confirmed; AIR Security researchers demonstrated two attack scenarios, according to Dark Reading.
What happened
According to Dark Reading, researchers at AIR Security discovered a flaw they call “Office Party” in Anthropic’s official DOCX, PPTX and XLSX skills. These skills let Claude create, read, edit and process Word, PowerPoint and Excel files. AIR Security published its report on the day of Dark Reading’s article. Dark Reading
Dark Reading reports that the issue sits in a helper script, soffice.py, which launches LibreOffice to convert documents. When Unix-domain sockets cannot be opened, the script falls back to a workaround that loads a shared library through the Linux LD_PRELOAD mechanism. It checks whether a library named lo_socket_shim.so already exists in a shared temporary directory, but does not verify its origin or contents, per the report. Dark Reading
AIR Security says an attacker who can place a malicious library at that location before the next document operation could have it loaded and run inside LibreOffice, with the privileges of the user running the AI agent. The researchers demonstrated two scenarios. In the first, they placed a malicious library in the temporary directory by hand before asking Claude Code to generate a document. In the second, a separate, seemingly legitimate AI skill unpacked a supporting file into the same directory. Dark Reading
AIR Security says it found the flaw in May and reported it to Anthropic. Anthropic acknowledged it but, according to the AIR researchers, considers it outside its security boundary because the vulnerable code only runs inside a sandbox. AIR says the script still uses the same fixed path. Dark Reading says Anthropic did not immediately respond to its request for comment. Dark Reading
What is not confirmed: no CVE identifier, affected version numbers or patch are given in the source. Exploitation in the wild is not reported. Anthropic’s own position comes only through AIR’s report, not from an Anthropic statement.
Am I affected?
According to AIR Security, the flaw affects Linux environments where Unix sockets are blocked. These include certain container security configurations and the Claude Code sandbox. AIR says macOS is not affected because it does not load the library through LD_PRELOAD. Dark Reading
Whether a specific deployment is affected is not confirmed by the source. Specific versions of the skills or of Claude Code are not listed.
What to do now
- Note that no fix exists as of the Dark Reading report. AIR says the helper script still loads whatever file it finds at the fixed path. Dark Reading
- Keep a live inventory of every AI skill and add-on installed across employees’ agents, as AIR Research Lab’s Niv Hoffman recommends. Dark Reading
- Treat AI skills as software dependencies, not trusted extensions, and review even official ones like any other code, according to AIR. Dark Reading
- Update or patch the whole set of skills whenever a new vulnerability is published, per Hoffman. Dark Reading
- Watch for a statement or change from Anthropic, since none is confirmed yet.