Unadvertised OpenCode Flaw Let Rogue MCP Servers Run Code on Developer PCs During Sign-In

A flaw in OpenCode, an AI coding agent, allowed a malicious or hijacked MCP (Model Context Protocol) server to run code on a developer's Windows or WSL machine when the developer signed in to it. Any such code would run with the developer's own access. The cause was that the server supplies the web address used for sign-in, and on Windows and WSL OpenCode passed that address to a PowerShell command without escaping it. Pillar Security, which found the flaw, rates it critical with a proposed severity score of 9.8 out of 10.

The risk applies only when a developer starts sign-in, for example by running opencode mcp auth. Simply configuring a server or opening a session does not trigger it. The attacker needs control of a remote MCP server the developer has added, but that server need not be hostile from the start: one that is later taken over, or a domain that changes hands, could carry the same address. macOS and Linux are not affected.

Anomaly, the company behind OpenCode, fixed the issue in version 1.18.33 on September 28. Affected builds run from 1.0.137 through 1.18.32. The fix was shipped as a routine refactor of browser-launch code, with no CVE and no security advisory. Anomaly's security policy says user-configured MCP servers are outside its trust boundary. That means vulnerability scanners and dependency alerts will not flag the risky versions, so teams need to check the installed OpenCode version directly.