# "Office Party" flaw in Anthropic Claude DOCX/PPTX/XLSX skills (soffice.py LD_PRELOAD shim) enables code execution on Linux

> AIR Security reported "Office Party", a flaw in Anthropic's official DOCX, PPTX and XLSX skills for Claude. The shared soffice.py helper loads a predictable /tmp/lo_socket_shim.so through LD_PRELOAD when Unix sockets are blocked, so an attacker who can plant that file gets code execution. Dark Reading reports the flaw as unresolved; no CVE has been assigned.

- **Published:** 2026-11-09T18:58:42Z
- **Last reviewed:** 2026-11-09T18:58:42Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5577
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5577.png
- **ID:** TL-2026-5577
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 9

## Description

Anthropic's official Office skills (docx, xlsx, pptx) each ship a helper script, soffice.py, that runs LibreOffice (soffice) headless to convert documents, for example rendering DOCX to PDF. The script describes itself as a helper for running LibreOffice in environments where AF_UNIX sockets may be blocked (e.g. sandboxed VMs).

Mechanism (from the upstream source and Trail of Bits): _needs_shim() tries to create an AF_UNIX socket and treats an OSError as a sign that the shim is needed. If so, _ensure_shim() uses the fixed path <tempdir>/lo_socket_shim.so. If that file already exists it is reused with no ownership or content check. Otherwise the script writes embedded C source to <tempdir>/lo_socket_shim.c, compiles it with 'gcc -shared -fPIC -ldl', and deletes the source. get_soffice_env() then sets LD_PRELOAD to the shim for the soffice child process. The shim intercepts socket(), listen(), accept() and close() and emulates AF_UNIX with socketpair().

AIR Security (via Dark Reading) dubbed this "Office Party". An attacker who can create a file in the temporary directory that Claude can access, for example a malicious lo_socket_shim.so, gets arbitrary native code executed inside the soffice process the next time a document is generated or converted. AIR demonstrated this by manually placing a malicious library in the temp directory before asking Claude Code to generate a document. Affected setups are Linux environments where Unix sockets are blocked, including some container security configurations and Claude Code's sandbox. AIR reports macOS is not affected because it does not use LD_PRELOAD. Dark Reading reports the flaw remains unresolved. AIR recommends treating AI skills as software dependencies rather than trusted extensions.

Trail of Bits independently described the same pattern on 2026-06-03, noting that a malicious /tmp/lo_socket_shim.so planted in a claude.ai or other sandbox would be patched in and executed without scrutiny of the compiled contents. It also noted that Cisco's skill-scanner rated the finding LOW (LLM analyzer) and MEDIUM (pattern rule). Third-party skill audits of copies of the skill flag the fixed path and the gcc compile step as high or medium risk. Their verdicts conflict, and some say the shim is purpose-aligned.

Limits of this record: the Dark Reading article body could not be retrieved (HTTP 403), so publication date, vendor response and exact scope come from search-result summaries. No CVE, CVSS score, in-the-wild exploitation or network IOCs were found. Severity is an analyst estimate. Exploitation needs a write primitive to the temp directory plus a trigger that makes Claude run the skill.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1059.006 Python
- T1574.006 Dynamic Linker Hijacking
- T1574.006 Dynamic Linker Hijacking
- T1574.006 Dynamic Linker Hijacking
- T1027.004 Compile After Delivery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Office Party - lo_socket_shim.so Planted by Non-Linker Process (Exploitation)** (`TL-2026-5577-SPL-001`)

Detects creation or modification of /tmp/lo_socket_shim.so by any process other than the GNU linker. The Anthropic docx/xlsx/pptx skills soffice.py helper reuses this fixed-path library through LD_PRELOAD with no ownership or content check, so a copy written by anything but the linker (collect2/ld during the skill's own gcc build) is the core exploit primitive of the Office Party flaw (TL-2026-5577, CWE-427/CWE-377). The planted library masquerades as the legitimate skill-built shim (T1036.005) by reusing its expected name and location, so name-based allowlists alone are insufficient; compare writer, owner and hash.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.006, T1195.002, T1036.005
- **Data sources:** sysmon_for_linux, linux_file_events, defender_for_endpoint_linux
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventCode=11 TargetFilename="*/lo_socket_shim.so" earliest=-24h
| where NOT (like(Image,"%/ld") OR like(Image,"%/ld.bfd") OR like(Image,"%/ld.gold") OR like(Image,"%/ld.lld") OR like(Image,"%/collect2") OR like(Image,"%-linux-gnu-ld%"))
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as writer_processes values(User) as users by host, TargetFilename
| convert ctime(first_seen) ctime(last_seen)
| table host TargetFilename writer_processes users count first_seen last_seen
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FileName =~ "lo_socket_shim.so"
| where not(InitiatingProcessFileName in~ ("ld", "ld.bfd", "ld.gold", "ld.lld", "collect2", "x86_64-linux-gnu-ld", "x86_64-linux-gnu-ld.bfd"))
| project Timestamp, DeviceName, ActionType, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
```

### Sigma

```yaml
title: Planted lo_socket_shim.so Written by Non-Linker Process
id: 5b1e7c3a-2f4d-4a8e-9c61-0d3f7a9b1e01
status: experimental
description: Detects creation of lo_socket_shim.so by a process other than the GNU linker. The Anthropic Office skills soffice.py helper loads this fixed-path library via LD_PRELOAD without ownership or content checks (Office Party, TL-2026-5577).
references:
    - https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/
    - https://github.com/anthropics/skills/blob/main/skills/docx/scripts/office/soffice.py
author: Threadlinqs Team
date: 2026/11/09
tags:
    - attack.initial_access
    - attack.t1195.002
    - attack.persistence
    - attack.privilege_escalation
    - attack.defense_evasion
    - attack.t1574.006
    - attack.t1036.005
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: '/lo_socket_shim.so'
    filter_linker:
        Image|endswith:
            - '/ld'
            - '/ld.bfd'
            - '/ld.gold'
            - '/ld.lld'
            - '/collect2'
    condition: selection and not filter_linker
falsepositives:
    - Administrators or CI jobs that pre-build and copy a trusted shim into the temp directory
    - Package or container image build steps that install a vetted shim
level: high
```

**Known false positives:**

- Administrators or CI jobs that pre-build and copy a trusted lo_socket_shim.so into the temp directory
- Container image build steps that install a vetted shim using cp, install or rsync

**Tuning notes:** Adjust index/sourcetype to your Sysmon for Linux ingestion. Add the image path of any approved build tooling to the writer exclusion list. Compare the SHA256 of hits against a trusted build of the shim; alert at critical if the writer is a download tool or interpreter (curl, wget, bash, python). Because the file deliberately reuses the trusted name, also compare its owner against the user that runs the skill (soffice.py performs no ownership check).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Office Party - LD_PRELOAD Pointing at Temp Path for soffice (Exploitation) (locked: unlock with TL Creds)
- Office Party - Lingering or Foreign lo_socket_shim.c Source File (Post-Exploitation / Tampered Build) (locked: unlock with TL Creds)
- Office Party - Outbound Public Connection from Headless LibreOffice (C2 / Callback) (locked: unlock with TL Creds)
- Office Party - Modification of Claude Office Skill [indicator] (Supply Chain / Exploitation) (locked: unlock with TL Creds)
- Office Party - soffice Launched by Python with lo_profile (Skill Execution Trigger) (locked: unlock with TL Creds)
- Office Party - Remote Access or Download Tools Spawned by LibreOffice (Lateral Movement / Tool Transfer) (locked: unlock with TL Creds)
- Office Party - Shim Compiled with gcc by Skill Helper (Post-Exploitation / Compile After Delivery) (locked: unlock with TL Creds)
- Office Party - LibreOffice soffice Spawning Shells or Interpreters (Post-Injection Execution) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Claude Flaw Threatens Linux Orgs with Malicious Code Execution (Dark Reading)](https://www.darkreading.com/endpoint-security/attackers-claude-office-party-flaw-malicious-code-linux)
- [The sorry state of skill distribution (Trail of Bits)](https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/)
- [anthropics/skills docx soffice.py (upstream source)](https://github.com/anthropics/skills/blob/main/skills/docx/scripts/office/soffice.py)
- [A Journey into Claude's Sandbox (Bishop Fox)](https://bishopfox.com/blog/journey-into-claudes-sandbox)
- [5 Claude Agent Skills Risks Every CISO Should Know (Cloud Security Alliance)](https://cloudsecurityalliance.org/blog/2026/06/25/5-claude-agent-skills-risks-every-ciso-should-know)
- [trailofbits/overtly-malicious-skills (proof-of-concept repository)](https://github.com/trailofbits/overtly-malicious-skills)
- [tl;dr sec #331 (summary of Trail of Bits skill-distribution research)](https://tldrsec.com/p/tldr-sec-331)
- [Skill Issues: Compromising Claude Code with Malicious Skills & Agents, Part 1 (Reversec)](https://labs.reversec.com/posts/2026/05/skill-issues-compromising-claude-code-with-malicious-skills-agents-part-1)
- [Skills, Connectors, Plugins, Oh My: A Security Practitioner's Map of the Claude Extension Ecosystem (Pluto Security)](https://pluto.security/blog/claude-extension-ecosystem-security-practitioner-guide/)
- [How Claude Code escapes its own denylist and sandbox (Ona)](https://ona.com/stories/how-claude-code-escapes-its-own-denylist-and-sandbox)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5577