News Vulnerabilities & Zero-Days

AI coding agent hijack: malicious MCP servers could run code on OpenCode users' Windows machines, fixed silently with no CVE

Pillar Security says a malicious remote MCP server could execute code on a developer's Windows or WSL machine during OpenCode's MCP sign-in, a flaw it rates CVSS 9.8. It was fixed in OpenCode 1.18.33 without a CVE or security advisory.

Published Updated
Illustration of an AI coding agent terminal on a Windows laptop, where a sign-in link from a shadowy MCP server hides a glowing PowerShell command.

Key takeaways

  • A malicious remote MCP server could run code on OpenCode users' Windows or WSL machines during sign-in.
  • Pillar Security rates the flaw CVSS 9.8; it affects OpenCode 1.0.137 to 1.18.32.
  • It was fixed in 1.18.33 on 28 September 2026 with no CVE or advisory.
  • OpenCode's maker said malicious MCP servers are outside its threat model.
  • Developers should update and remove unvetted MCP servers.

A flaw in OpenCode, an open-source AI coding agent, let a malicious remote MCP (Model Context Protocol) server run code on a developer's computer during sign-in, according to research by Eilon Cohen of Pillar Security. The flaw was fixed in OpenCode 1.18.33 on 28 September 2026, but no CVE or security advisory was issued, so many users may not know they need to update.

How did the attack work? #

MCP servers let AI agents connect to outside tools and data. When a remote MCP server requires sign-in, OpenCode opens the server's OAuth authorization address in the user's browser.

Pillar found that OpenCode passed the server-supplied address to the open package, which on Windows sent it to PowerShell without escaping it. Because PowerShell expands $(...) inside double quotes, a malicious server could hide a command inside an otherwise valid https:// address, and the command would run on the developer's machine with no extra click or consent.

Detail Value
Affected versions OpenCode 1.0.137 to 1.18.32
Fixed version 1.18.33 (28 September 2026)
Platforms Windows and WSL; macOS and Linux not affected
Proposed severity CVSS 9.8 (critical)
CVE None issued

How did the vendor respond? #

Pillar says it reported the flaw privately on 29 August 2026. OpenCode's maker, Anomaly, replied that "trying to deal with a malicious MCP server is outside our threat model." Pillar says the decisive fix was upgrading the open package to 11.0.4, which wraps the address in single quotes, and that OpenCode's added URL scheme checks would not have stopped this payload on their own.

Why does it matter? #

AI coding agents increasingly connect to third-party MCP servers. This case shows that simply signing in to a malicious or compromised server could be enough to compromise a developer machine, which often holds source code, cloud credentials and access tokens.

What should developers do? #

  1. Update OpenCode to 1.18.33 or later, especially on Windows and WSL.
  2. Check installed versions directly, since vulnerability scanners will not flag a flaw with no CVE.
  3. Remove remote MCP servers you have not vetted from your configuration.
  4. If you build tools that open URLs, pass them as arguments to processes rather than building shell commands, and do not rely on URL scheme checks alone.

Sources

  1. Pillar Security: remote code execution in OpenCode via MCP OAuth, Pillar Security
  2. Researchers warn OpenCode quietly patched critical RCE flaw, Infosecurity Magazine

Questions this raises

Am I affected on macOS or Linux?
Pillar Security says macOS and Linux are not affected. Windows and WSL users on OpenCode 1.0.137 to 1.18.32 are.
Why didn't my scanner flag this?
No CVE or security advisory was issued, so scanners that rely on CVEs will not detect it. Check your OpenCode version directly.
What is an MCP server?
A server using the Model Context Protocol, which lets AI agents connect to external tools and data sources.

AI SecurityAI AgentsVulnerabilityApplication SecurityOpen Source SecurityMCPOpenCode