A flaw in the OpenCode AI coding agent could allow a malicious or hijacked MCP server to execute code on a developer’s Windows or Windows Subsystem for Linux (WSL) machine during sign-in. OpenCode connects to MCP (Model Context Protocol) servers to bring in external tools, and, if exploited, any code would run with the attacker’s access on the developer’s device. The company behind OpenCode, Anomaly, fixed the flaw in version 1.18.33 on 28 September.
Notably, Anomaly did not request a CVE or publish a security advisory, so vulnerability scanners will not flag the affected builds (1.0.137 through 1.18.32) as at risk.
The vulnerability arises when, during sign-in, the MCP server supplies an authorization endpoint URL which is handed to a helper that opens it in a browser on Windows/WSL. The helper wraps the address in a PowerShell command without escaping, enabling a malicious endpoint to execute commands. An attacker would need control of a remote MCP server configured by the developer; the server does not need to be hostile from the outset, just later compromised or change hands.
There is no known exploitation indicated by Pillar Security, which privately disclosed the flaw, and no CVE has been assigned, meaning scanners won’t flag the issue. Practical responses recommended in the article are to upgrade to OpenCode 1.18.33 or later; if upgrading isn’t possible yet, remove unvetted remote MCP servers from the OpenCode configuration and run opencode mcp list to verify configured servers.