Pillar Security disclosed a critical flaw in OpenCode, the open-source AI coding agent, on October 19. When a developer on Windows or the Windows Subsystem for Linux (WSL) signs in to a remote MCP (Model Context Protocol) server, that server supplies the web address the user is sent to. OpenCode passed the address to a helper that opens a browser by building a PowerShell command without escaping it, so an address written to carry a command would run it, with the developer’s own access. Pillar says the payload arrives in an ordinary HTTPS address, so checking that an address uses HTTP or HTTPS does not stop it. macOS and Linux are not affected.
The developer, Anomaly, fixed the flaw in version 1.18.33 on September 28, but shipped it as a refactor of browser-launch code. According to Pillar and The Hacker News, it did not request a CVE or publish an advisory, saying malicious MCP servers a user configures fall outside its trust boundary; The Hacker News reports Pillar first reported the issue privately on August 29. Because there is no CVE, vulnerability scanners and dependency alerts will not flag affected installs. Pillar reported no signs of attacks and published no indicators of past exploitation. The flaw is separate from the OpenCode Console breach we covered earlier this week.
How to check if you’re affected
Affected versions are OpenCode 1.0.137 through 1.18.32 running on Windows or WSL, according to The Hacker News. Check the installed version directly, since no scanner will report it.
- Upgrade to OpenCode 1.18.33 or later.
- The attack runs only when a developer starts a sign-in to a remote MCP server, for example with
opencode mcp auth; having a server configured does not by itself trigger it. The server does not need to be hostile when added: Pillar notes a later takeover, hijacked registry entry or expired domain could deliver the same payload. - If you cannot upgrade yet, The Hacker News advises removing remote MCP servers you have not vetted from your OpenCode configuration;
opencode mcp listshows what is configured. - Organizations should inventory OpenCode installs on Windows and WSL machines directly rather than relying on vulnerability scanners.