OpenCode Patches Critical Remote Code Execution Flaw via MCP
A flaw in the OpenCode AI coding agent let a malicious remote MCP server execute code on a developer's Windows machine during the OAuth sign-in, with no user interaction, according to Pillar Security. Versions 1.0.137 through 1.18.32 on Windows and WSL are exposed, and Anomaly fixed the issue in version 1.18.33 with no advisory or CVE, so scanners will not flag it. Upgrade to 1.18.33 or later and review which MCP servers your agents connect to.
What happened
A flaw in the OpenCode coding agent let a malicious remote MCP server execute code on the developer's machine during sign-in, with no user interaction. The issue affects versions 1.0.137 through 1.18.32 on Windows and WSL. It was discovered by Pillar Security and disclosed on October 19, 2026.
Why it matters
With the developer's privileges, an attacker could reach source code, credentials and internal systems accessible to that user. According to Pillar Security, OpenCode has roughly 3 million weekly npm downloads. Because Anomaly issued no advisory or CVE, vulnerability scanners and dependency alerts will not flag the flaw.
What to do
Upgrade OpenCode to version 1.18.33 or later on Windows and WSL. Inventory installations directly rather than relying on automated tooling, and review which remote MCP servers your agents are trusted to connect to.
For the technical team
- Affected
- Anomaly OpenCode AI coding agent no Windows e WSL · OpenCode 1.0.137 through 1.18.32 on Windows and WSL.
- Exploitation
- No exploitation in the wild reported in the sources. Disclosed by Pillar Security on October 19, 2026, with research by Eilon Cohen. No public PoC cited, and no advisory or CVE issued by Anomaly, so vulnerability scanners and dependency alerts will not flag it.
- Fix
- Upgrade to OpenCode 1.18.33 or later. Additional mitigation: inventory installations and review trusted remote MCP servers. Pillar Security warns that URL scheme validation, the commonly recommended fix, does not stop the attack because the payload is a plain https:// URL.
- Vector
- OAuth handshake with a remote MCP server. OpenCode opened the server-supplied authorization URL without validation; on Windows and WSL the URL reached PowerShell unescaped, allowing code execution with the developer's privileges. No user interaction, no malware install, no model exploit and no prompt injection required.
- More details
- The same vulnerability class appeared in three CVEs in 2025 and resurfaced here, according to Pillar Security. The product is the open-source AI coding agent by Anomaly, with roughly 3 million weekly npm downloads (figure from Pillar Security).
Timeline
Incident opened.
Sources 2 sources
- OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL The Hacker News
- Pillar Security disclosure post on X Pillar Security
