Threat
Attackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on Linux
First reported darkreading.com
Page published
Earliest dated coverage: 9 Nov 2026 · First observed: 9 Nov 2026 · Latest dated coverage: 9 Nov 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
Office Party could turn Claude's trusted document-conversion workflow into a malicious-code execution path in Linux environments running the affected skills.
AIR Security reported “Office Party,” a code-execution flaw in Anthropic's official DOCX, PPTX, and XLSX skills that can execute an attacker-created temporary file on Linux. The vulnerability involves the soffice.py document-conversion helper's fallback to loading a shared library through LD_PRELOAD when Unix-domain sockets are unavailable.