OpenCode: a malicious MCP server could run code on Windows during OAuth sign-in

What is this?

On 19 October 2026, Pillar Security (research by Eilon Cohen) publicly described a critical flaw in OpenCode, the open-source AI coding agent from Anomaly. On Windows and WSL, a malicious or hijacked remote MCP server could execute commands with the developer’s privileges when the developer authenticated to that server through OAuth. Pillar rated it CVSS 9.8. It was reported privately at the end of August 2026 and fixed in version 1.18.33 on 28 September 2026. Affected versions are 1.0.137 through 1.18.32. Coverage appeared on 20 October (Infosecurity Magazine) and 22 October 2026 (The Hacker News).

How it works

During MCP OAuth, the remote server supplies the “authorization endpoint” URL that the agent opens in the browser. On Windows, OpenCode passed that URL to a helper package that built a PowerShell command around it without proper escaping, so parts of a crafted URL could be interpreted as commands. The payload can sit inside an ordinary-looking HTTPS URL, so a simple http/https scheme check does not stop it. The step only runs when sign-in starts (for example with opencode mcp auth); merely configuring a server or opening a session does not trigger it. The attacker must control a remote MCP server the developer has added, for instance after a takeover or a domain changing hands. macOS and Linux are not affected. No exploitation in the wild was reported.

Why it matters

Coding agents run with the developer’s credentials, repositories and shell, so code execution here is a full workstation compromise. Pillar also notes that the vendor treats user-configured MCP servers as outside its trust boundary and issued neither a CVE nor an advisory, so dependency scanners may not flag vulnerable installs. The fix landed in a change described as a browser-launch refactor, which makes it easy to miss in release notes.

Defenses

• Upgrade to OpenCode 1.18.33 or later and confirm the escaping fix in the underlying dependency is included.
• Review configured remote servers with opencode mcp list and remove any you cannot vouch for.
• Treat every URL supplied by a remote server as untrusted: never interpolate it into a shell string; launch browsers with argument-based process execution.
• Do not rely on scheme allow-lists alone for URL handling.
• Track agent tools by version in your inventory even when no CVE exists.

Status

Aspect	Detail
Researcher	Pillar Security
Reported / fixed / public	End Aug 2026 / 28 Sep 2026 (1.18.33) / 19 Oct 2026
Affected	OpenCode 1.0.137 – 1.18.32, Windows and WSL
Identifier	No CVE or advisory issued