A Critical Flaw in Claude’s Document-Processing Tool Exposes Linux Systems to Malicious Code
A potentially devastating vulnerability has been discovered in Anthropic’s document-processing tool, used by its popular AI assistant, Claude. The flaw, dubbed “Office Party,” allows attackers to run malicious code on Linux systems simply by creating a temporary file that the AI can access and execute. This security gap affects hundreds of millions of users who rely on Claude for tasks such as document creation and editing.
The vulnerability stems from a helper script, soffice.py, which launches LibreOffice to convert documents. When this script encounters an environment where Unix-domain sockets cannot be opened, it uses a workaround that loads a shared library through the Linux LD_PRELOAD mechanism. An attacker can exploit this weakness by placing a malicious library in a shared temporary directory used by many programs, including Claude. The next time an employee asks Claude for a document, Anthropic’s trusted skill will load and run the malicious file with the privileges of the user running the AI agent.
This flaw is particularly concerning because it highlights a growing risk posed by even trusted AI tools to introduce security gaps in enterprise environments. Anthropic has opted not to fix the issue, claiming that the vulnerable code only runs inside a sandbox. However, this argument ignores the fact that attackers can still exploit the weakness and run malicious code on a user’s Linux machine.
The vulnerability affects Linux environments where Unix sockets are blocked, including certain container security configurations, and Claude Code’s sandbox. Researchers from AIR Security demonstrated two ways the attack can work on Linux systems: by manually placing a malicious library in the temporary directory or using a seemingly legitimate AI skill to unpack a supporting file into the same directory.
This issue presents a serious problem for enterprises running Linux because it exploits “the default skills that all Claude agents use — hundreds of millions — and one planted file can make them run an attacker’s code with the employee’s own access,” according to Niv Hoffman, co-founder and CTO of AIR Research Lab. The fact that companies often don’t have visibility into which AI skills and agent add-ons they have installed makes this vulnerability even more concerning.
Moreover, a malicious or compromised skill does not necessarily need to exploit the document-processing tool directly; it may simply need to place a file that another trusted component will execute. This highlights the importance of monitoring and controlling AI interactions in enterprise environments.
The Office Party flaw was discovered in May by AIR Security, who reported it to Anthropic but received no resolution. The vulnerability remains unresolved, leaving Linux users vulnerable to attacks that can compromise their systems with malicious code. Users are advised to exercise extreme caution when using Claude’s document-processing tool and to ensure that all AI skills and agent add-ons are up-to-date and securely configured.
Practical takeaway: Enterprises running Linux should immediately review their AI interactions and configuration to prevent potential exploitation of the Office Party flaw. This includes monitoring and controlling AI skill usage, ensuring visibility into installed skills and agent add-ons, and regularly updating and patching all AI-related software.
Source: Dark Reading — 2026-11-09