News Vulnerabilities & Zero-Days
AI coding agent hijack: malicious MCP servers could run code on OpenCode users' Windows machines, fixed silently with no CVE
Pillar Security says a malicious remote MCP server could execute code on a developer's Windows or WSL machine during OpenCode's MCP sign-in, a flaw it rates CVSS 9.8. It was fixed in OpenCode 1.18.33 without a CVE or security advisory.
Jay B.