A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer’s Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer’s own access.
Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September 28. It did not request a CVE or publish a security advisory, so vulnerability scanners will not flag the builds still at risk: 1.0.137 through 1.18.32.
During that sign-in, the server itself supplies the web address the user is sent to, an OAuth “authorization endpoint.” On Windows and WSL, OpenCode handed that address to a helper that opens it in a browser. The helper built a PowerShell command around the address without escaping it, so an address written to carry a PowerShell command would run that command.
The browser step runs only when a developer starts the sign-in, by running opencode mcp auth or making the matching request. Having the server configured, or opening a session, does not reach it.
The attacker needs control of a remote MCP server the developer has added, and that server need not be hostile from the start. One that is later taken over, or a domain that changes hands, could carry the same address.
Pillar Security, which found the flaw and disclosed it on October 19, rates it critical, with a proposed severity score of 9.8 out of 10.
The flaw affects OpenCode on Windows and the Windows Subsystem for Linux (WSL). macOS and Linux are not affected, because OpenCode opens the browser there without passing the address through a shell.
OpenCode shipped the fix as a routine change. The pull request that carried it is described as a refactor of browser-launch code, and neither it nor the release notes mention a security flaw.
Anomaly did not request a CVE or publish an advisory. Its security policy says MCP servers that a user configures are “outside our trust boundary.”
Pillar reported the flaw privately on August 29 and later asked Anomaly to reconsider and request a CVE. Anomaly’s answer was that a malicious MCP server falls outside its threat model, according to Pillar.
Because there is no CVE, the flaw will not show up in scanners or dependency alerts, so finding affected installs means checking the OpenCode version directly. Anomaly has published advisories for other OpenCode code-execution flaws this year, including one fixed in August.
The same kind of flaw has surfaced before. In July 2025, the mcp-remote proxy carried an almost identical bug, in which a malicious server’s authorization endpoint reached the command line. It was assigned CVE-2025-6514.
OpenCode’s browser helper is a widely used package called open. Its Windows behavior was reported as a command-injection risk in 2023 and fixed in open’s version 11, but OpenCode stayed on an older release.
The usual defense for this class is to check that the address uses HTTP or HTTPS. It does not help here, because the attack uses an ordinary HTTPS address. OpenCode added that check as well, but the hole was closed by updating it to the fixed version.
What to Do
Anyone running OpenCode on Windows or WSL should upgrade and check which servers they are connected to.
- Upgrade to OpenCode 1.18.33 or later.
- If you cannot upgrade yet, remove any remote MCP servers you have not vetted from your OpenCode configuration.
- Run opencode mcp list to see which servers are configured.
Pillar reported no signs that the flaw has been used in attacks and published no indicators to check for past exploitation. The flaw is separate from a breach of OpenCode’s hosted Console disclosed around the same time, which may have exposed some users’ stored API keys for OpenAI, Anthropic, and Google.
