OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

What happened

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL  Swati Khandelwal  Oct 22, 2026 Vulnerability / Artificial Intelligence A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in.

The attacker needs control of a remote MCP server the developer has added, and that server need not be hostile from the start. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access.

Anomaly , the company behind OpenCode, fixed the flaw in version 1.18.33 on September 28. It did not request a CVE or publish a security advisory, so vulnerability scanners will not flag the builds still at risk: 1.0.137 through 1.18.32.

During that sign-in, the server itself supplies the web address the user is sent to, an OAuth "authorization endpoint." On Windows and WSL, OpenCode handed that address to a helper that opens it in a browser.

The helper built a PowerShell command around the address without escaping it, so an address written to carry a PowerShell command would run that command. The browser step runs only when a developer starts the sign-in, by running opencode mcp auth or making the matching request.

Having the server configured, or opening a session, does not reach it. One that is later taken over, or a domain that changes hands, could carry the same address.