Claude Document-Processing Flaw Could Run Attacker Code on Linux
Summary
AIR Security reports that Claude’s Office Party flaw can load an attacker-controlled library during document processing on some Linux systems, potentially executing code with the AI agent user’s privileges. Anthropic has not fixed it.
Key points
- AIR Security found the Office Party flaw in Anthropic’s official DOCX, PPTX, and XLSX skills.
- When Unix-domain sockets cannot be opened, the soffice.py helper uses LD_PRELOAD to load a shared library.
- The script checks for lo_socket_shim.so in a shared temporary directory but does not verify its origin or contents.
- Researchers demonstrated attacks by placing a malicious library in the directory directly or using another AI skill to unpack a supporting file there.
- The flaw affects certain Linux configurations, including some container security setups and Claude Code’s sandbox; macOS is not affected.
- AIR Security says Anthropic acknowledged the flaw but considers it outside its security boundary; the issue remains unresolved.
- AIR recommends maintaining an inventory of AI skills and add-ons and reviewing and updating them like other software dependencies.
Article Details
- Vulnerability Types
- Unverified shared-library loading enabling malicious code execution
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Maintain a live inventory of Claude Code skills and add-ons across employees’ agents.
- Review official skills like other code and update or patch the skill set when vulnerabilities are published.
MITRE ATT&CK
People
Vendors
Products
ClaudeAn attacker can use a flaw in Anthropic Claude's document-processing tool to run malicious code on Linux systems just by creating a temporary file that the AI assistant can access. The flaw highlights a growing riskClaude Codeenvironments where Unix sockets are blocked, including certain container security configurations, and Claude Code's sandbox. AIR Security reports that macOS is not affected because it does not load the library throughLibreOfficeThe vulnerability stems from a helper script, soffice.py, that launches LibreOffice to convert documents, including rendering Word documents as PDFs, they revealed in a report published today. When the script encounters