Researchers Say Popular AI Coding Tool OpenCode Was Quietly Patched for a Critical Flaw

Researchers at Pillar Security have warned that a critical vulnerability in OpenCode, an open-source AI coding agent with over 218,000 GitHub stars, was patched without public notice. Eilon Cohen, head of security research at Pillar Security, reported that versions 1.0.137 to 1.18.32 are affected on Windows and Windows Subsystem for Linux (WSL). A malicious remote model context protocol (MCP) server could run code on a developer's machine during an MCP OAuth sign-in, with no extra user interaction or consent.

Pillar says it reported the issue privately at the end of August 2026. A month later, OpenCode's maker, Anomaly, confirmed receipt but said malicious MCP servers are "outside their threat model". The fix arrived on September 28 in version 1.18.33, with no CVE or security advisory. Pillar warns that this means conventional vulnerability scanners and dependency alerts will not identify affected installations. The researchers rate the flaw as critical, with a CVSS score of 9.8.

Pillar also argues the fix alone may not be enough. Checking URL schemes does not stop the attack, because the malicious content can sit inside a normal-looking HTTPS URL. On Windows, a dependency passed the URL to PowerShell without proper escaping, so part of it could be read as a command. Pillar says the key fix is updating that dependency so it quotes the URL correctly. It also advises developers to avoid passing untrusted URLs through shell commands and to use argument-based process execution instead.