What happened

Through a bug in OpenCode, an AI coding agent, an MCP server that was hostile or had been taken over could execute code on a developer's Windows or WSL computer as soon as the developer signed in to it. Anything run this way had the same access as the developer.

Anomaly, which makes OpenCode, fixed the problem in version 1.18.33, released on 28 September. It requested no CVE and published no advisory, so vulnerability scanners will not flag builds 1.0.137 through 1.18.32. The release notes and the pull request describe the change as routine browser-launch work and do not mention a security issue.

Pillar Security found the flaw, reported it privately on 29 August and disclosed it on 19 October, rating it critical with a proposed score of 9.8 out of 10. According to Pillar, Anomaly declined to request a CVE, answering that a malicious MCP server is outside its threat model. OpenCode's own security policy says MCP servers a user configures sit outside its trust boundary.

Pillar reported no sign that the flaw was used in attacks and published no indicators. The bug is unrelated to the breach of OpenCode's hosted Console that came to light around the same time.

Background

OpenCode is an AI coding assistant that runs locally and gives its agent shell, file and web tools. Its policy states that it does not sandbox the agent. This year Anomaly has also issued advisories for other code-execution bugs in OpenCode, one of them patched in August.

How it works

When a developer signs in to a remote MCP server, the server itself tells OpenCode which OAuth authorization address to open. On Windows and WSL, OpenCode passed that address to a browser-opening helper that wrapped it in a PowerShell command without escaping it, so an address crafted to carry a command would run that command. On macOS and Linux the browser is opened without going through a shell, so those systems are not affected.

The vulnerable step only runs when the developer starts sign-in, for example with opencode mcp auth; merely having the server configured or opening a session does not trigger it. An attacker has to control a remote MCP server the developer already added, and that server could turn bad later, through a takeover or a domain that changes owners.

The helper is the widely used open package, whose Windows behavior was flagged as a command-injection risk in 2023 and fixed in its version 11, while OpenCode kept an older release. Limiting the address to HTTP or HTTPS would not have stopped the attack, which uses an ordinary HTTPS address. The mcp-remote proxy had an almost identical bug in July 2025, tracked as CVE-2025-6514.

Timeline

  1. Pillar Security privately reports the flaw to Anomaly.[1]

  2. OpenCode 1.18.33 ships with the fix.[1]

  3. Pillar Security discloses the flaw.[1]

Who is affected

  • People running OpenCode 1.0.137 through 1.18.32 on Windows or WSL.
  • OpenCode on macOS and Linux is not affected.

How to check

  1. Check your OpenCode version directly, because no CVE exists for scanners or dependency alerts to match.

What to do

  1. On Windows or WSL, upgrade OpenCode to 1.18.33 or later and review which MCP servers it connects to.
  2. Until you can upgrade, take unvetted remote MCP servers out of your OpenCode settings.

Sources

Changelog

  1. First published.