# Office Party: a planted temp file runs code in Anthropic's Office skills

> AIR Security found that Anthropic's Office skills will load a shim library any local writer can plant first.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability, Supply chain
- **Published by:** AIR Security
- **Disclosed:** 2026-11-05
- **Affects:** Claude Code, Anthropic document skills
- **Research by:** Omri Saxena, Or Nevo
- **Primary source:** https://www.air.security/blog-posts/office-party
- **Page:** https://theinjection.dev/items/air-office-party/

Office Party is a code execution flaw in Anthropic's docx, pptx and xlsx skills. Their LibreOffice helper preloads a shim library from a fixed temp path without checking who wrote it. Anthropic calls the flaw out of scope.

## What happened

AIR Security published Office Party on November 5, 2026, a code execution flaw in the docx, pptx and xlsx skills that Anthropic ships. Researchers Omri Saxena and Or Nevo reported it to Anthropic in May 2026. Anthropic acknowledged the report and says the code runs only inside a sandbox, so the flaw sits outside the boundary it defends.

## How it works

The three skills share a helper script, scripts/office/soffice.py, that drives LibreOffice. When the helper cannot open a Unix socket, it compiles a small C shim and preloads it into LibreOffice through LD_PRELOAD. The shim path is fixed: lo_socket_shim.so in the system temp directory. AIR reports the helper reuses any file already sitting at that path without checking who created it, so whoever writes it first decides what LibreOffice runs.

## Who is affected

Linux hosts are exposed, and only when something blocks Unix socket creation: a container seccomp profile, a hardened systemd unit, or Claude Code's own sandbox. macOS ignores LD_PRELOAD and is not affected. AIR tested Anthropic's document-skills plugin directly.

## What to do

Inventory the skills each agent can load, and review their helper scripts as code you execute rather than trusted vendor content. On Linux hosts, stop agents from sharing a temp directory with other users and processes.

## Quick facts

- **Affected:** Anthropic docx, pptx and xlsx skills, on Linux
- **Attack type:** Local code execution through a preloaded library
- **Found by:** Omri Saxena and Or Nevo, AIR Security
- **Reported:** May 2026
- **Disclosed:** 2026-11-05
- **Status:** Unfixed. Anthropic calls it outside its security boundary
- **CVE:** None assigned

## Questions

### Is there a patch for the Office Party flaw in Anthropic's Office skills?

No patch existed as of November 5, 2026. AIR Security reports that soffice.py on the main branch of anthropics/skills had not changed since July 17 and still builds its shim at a fixed temp path. Anthropic acknowledged the report but treats the code as sandbox-internal, so the flaw falls outside the boundary Anthropic defends.

### Does Office Party affect macOS or only Linux?

Office Party affects Linux only. The attack depends on LD_PRELOAD, which macOS ignores, so Macs running the same docx, pptx and xlsx skills are not exposed. On Linux the flaw needs a second condition as well: something must block Unix socket creation, such as a container seccomp profile, a hardened systemd unit, or Claude Code's sandbox.

### Which Anthropic skills ship the vulnerable LibreOffice helper?

Anthropic's docx, pptx and xlsx skills all ship the same scripts/office/soffice.py helper, and AIR Security tested the document-skills plugin directly. The docx skill uses the helper to render documents to PDF. Any agent that loads one of these three skills on a Linux host where socket creation is blocked will reach the preload path.

## Sources

1. [AIR Research](https://www.air.security/blog-posts/office-party)
2. [Skill Helper Script](https://github.com/anthropics/skills/blob/main/skills/docx/scripts/office/soffice.py)
3. [Anthropic Skills Repo](https://github.com/anthropics/skills)