OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

Summary

Anomaly's OpenCode AI coding agent on Windows and WSL passed a server-supplied OAuth authorization endpoint to a browser helper that built an unescaped PowerShell command, so a malicious or hijacked remote MCP server could run code during the developer's sign-in. Anomaly fixed it in version 1.18.33 on September 28 without requesting a CVE or publishing an advisory, and Pillar Security, which disclosed it on October 19, rates it critical at 9.8 out of 10.

Mitigation

Upgrade to OpenCode 1.18.33 or later. If you cannot upgrade yet, remove any remote MCP servers you have not vetted from your OpenCode configuration. Run opencode mcp list to see which servers are configured.

Topics

• Model Context Protocol

Related items

• MediumChinese hackers spied on thousands of companies after breaching IT giant ConnectWiseSimilar attack · TechCrunch (Security)
• MediumLiteLLM release pipeline hacked to distribute credential-stealing malwareSimilar attack · CSO Online
• HighCVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()Similar attack · AWS Security Bulletins
• MediumAI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromiseSimilar attack · Microsoft Security Blog
• MediumLiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI CredentialsSimilar attack · Socket Blog