Return to Threats

OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

thehackernews.com 2026-10-22 AI supply chain Critical
Run AI Security Assessment Talk to AI CISO

Executive Summary

A malicious or compromised MCP server could execute code during OpenCode sign-in on Windows and WSL. Developers and organizations using OpenCode with external MCP servers should review their integrations and upgrade to version 1.18.33.

What Happened

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access. Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September

Affected Products

  • OpenCode AI coding agent
  • MCP (Model Context Protocol) servers
  • Windows
  • Windows Subsystem for Linux (WSL)

Vulnerability / Attack Technique

MCP server-supplied command injection during OAuth sign-in

Technical Mechanism

During sign-in, the MCP server supplied the OAuth authorization endpoint that OpenCode opened in a browser. On Windows and WSL, a helper embedded that address in a PowerShell command without escaping it, allowing a crafted address to carry and execute PowerShell code.

AI Security Category

LLM03:2025 Supply Chain

Part of the MCP Security topic.

Part of the AI Supply Chain and AI SBOM topic.

Relevant Frameworks

LLM03:2025 Supply ChainLLM06:2025 Excessive AgencyMITRE ATLAS: Initial AccessMITRE ATLAS: Execution

RealGround Analysis

RealGround analysis: MCP servers extend an AI agent’s capabilities, so a compromised integration can become an execution path on a developer workstation. The incident shows that agent supply-chain reviews must cover authentication flows and helper utilities, not only model prompts and tool permissions.

Recommended Controls

  • Upgrade OpenCode to version 1.18.33 or later on Windows and WSL systems.
  • Maintain an inventory and SBOM of connected MCP servers and agent dependencies.
  • Allow MCP connections only to approved, authenticated, and integrity-verified servers.
  • Review OAuth authorization endpoints and reject untrusted or unexpected endpoint values before browser launch.
  • Run AI coding agents with least-privilege OS accounts and restrict PowerShell execution where operationally feasible.

Related RealGround Service

AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.

Sources

thehackernews.com: https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html

Summary and analysis written by RealGround from the source above; last updated 2026-10-23.

Talk to AI CISO