Researchers find Claude document flaw allows code execution on Linux

Researchers find Claude document flaw allows Code execution on Linux Dark Reading reports a flaw named Office Party in Anthropic’s DOCX, PPTX, and XLSX skills that affects Linux systems with blocked Unix sockets. On Nov. 9, 2026, Dark Reading reported that researchers from AIR Security discovered a flaw in Anthropic Claude‘s document-processing tool that allows attackers to execute malicious code on Linux by creating a temporary file the assistant can access. The flaw, named Office Party by AIR Security, is built into Anthropic’s official DOCX, PPTX, and XLSX skills. These skills enable Claude to handle Microsoft Word documents, PowerPoint presentations, and Excel spreadsheets, including creating, reading, and editing them.

A helper script named soffice.py triggers the flaw by launching LibreOffice to convert documents, a step that includes turning Word files into PDFs. If Unix-domain sockets are unavailable, soffice.py works around this by loading a shared library via the Linux LD_PRELOAD mechanism. While processing a conversation, soffice.py looks for a file named lo_socket_shim.so in a shared temporary directory, but it does not check where the file came from or what it contains. Omri Saxena and Or Nevo of AIR Research Lab said the script still loads any file it finds at that location.

An attacker who places a malicious library in that directory before the next document-processing operation causes LibreOffice to load and run the code with the permissions of the user who is running the AI agent. According to the Dark Reading report, AIR Security researchers found the flaw in May and told Anthropic about it, and Anthropic acknowledged that it exists. Anthropic has opted not to fix the issue, treating it as outside its security boundary because the affected code runs only within a sandbox. Niv Hoffman, co-founder and chief technology officer of AIR Research Lab, said in an e-mail interview with Dark Reading that Anthropic’s response is not adequate and that malicious code runs inside the sandbox using the user’s permissions, where the user’s files and work already exist.

Hoffman said an attacker places a malicious file in a shared temporary folder used by many programs, and that when an employee asks Claude for a document, the trusted skill loads and runs that file. Dark Reading said Anthropic did not immediately reply to its request for comment on further action to fix the issue. The Dark Reading article noted that the flaw affects Linux systems with blocked Unix sockets, including some container security setups and Claude Code’s sandbox. macOS escapes the flaw because the operating system never loads the library via LD_PRELOAD. In one demonstration, AIR researchers put a harmful library into the temp folder and then asked Claude Code to create a document.

For the second demonstration, they used an apparently legitimate AI skill to extract a supporting file into that directory, and after the document-processing skill ran, the malicious library loaded automatically. The report also said that a malicious or compromised skill can place a file for another trusted component to execute. Niv Hoffman said the flaw affects default skills used by all Claude agents, which number in the hundreds of millions, and that one planted file can make those skills run attacker code with the employee’s own access. In the interview, he said, “An attacker gets one malicious file into a shared temporary folder which many programs use.”

He added that companies often lack visibility into which skills and agent add-ons they have installed, and that there is no red button to revoke or patch a vulnerable skill. AIR researchers said the flaw shows that AI skills should be treated as software dependencies, not trusted extensions, and that organizations should secure AI skills as such. Niv Hoffman recommended that organizations maintain a current list of all AI skills and add-ons used by employee agents, which lets them know exactly what they use with Claude Code. He also said organizations should review even official skills like any other code and update or patch the entire collection when a new vulnerability is disclosed.

Dark Reading said the flaw shows how even trusted AI tools can create security gaps in enterprise environments. The outlet also noted that the second scenario demonstrates how separate AI skills that look harmless can work together to form an attack chain.