A critical flaw in the open-source AI coding agent OpenCode let a remote MCP server run code on Windows developer machines simply by starting an OAuth login. The vendor patched it about three weeks ago but shipped no CVE or advisory, so most vulnerability scanners will never flag an unpatched install.
What happened
On 19 October 2026, Pillar Security published research by Eilon Cohen describing a remote code execution flaw in OpenCode, a widely used open-source AI coding agent developed by Anomaly. Pillar puts its reach at around three million weekly npm downloads.
The bug affects the opencode-ai package from version 1.0.137 up to and including 1.18.32, but only on Windows and Windows Subsystem for Linux (WSL). Pillar says macOS and Linux builds are not exposed. An attacker who controls a remote Model Context Protocol (MCP) server that a developer has connected to could execute arbitrary commands on that developer’s machine during the MCP OAuth sign-in step, with no further clicks or consent. Pillar classes it as OS command injection (CWE-78) and proposes a CVSS v3.1 score of 9.8.
The disclosure timeline is the part that should worry security teams. Pillar reported the issue privately through a GitHub security advisory on 29 August. Anomaly acknowledged it in late September, merged a fix and released version 1.18.33 on 28 September. According to Pillar, the company told the researchers that malicious MCP servers sit “outside their threat model” and did not request a CVE or publish an advisory. The release notes for 1.18.33 list four bug fixes, including one about MCP browser launch failures, and do not describe any security fix.
Infosecurity Magazine, which reported the research on 20 October, notes that this is a separate issue from the recent OpenCode Console incident in which stored AI provider keys may have been exposed.
The technical picture
MCP is the protocol AI agents use to reach external tools and data: ticketing systems, databases, cloud consoles and in-house services. When a remote MCP server needs the user to authenticate, the client performs OAuth discovery. The server replies with metadata documents, and one field in that metadata, the authorization_endpoint, tells the client which login page to open in the browser.
That value is chosen entirely by the server. In the affected OpenCode releases it travelled through the MCP SDK and several internal modules before being handed to open, a hugely popular npm package for launching a browser. On macOS and Linux that package starts the browser with a list of arguments, so no shell is involved. On Windows, the pinned version (10.1.2) instead built a PowerShell command and failed to escape the URL. PowerShell evaluates certain expressions inside double-quoted strings, so a crafted login URL became a command.
Two details make this more than a routine injection bug. First, the malicious string can be a perfectly normal-looking HTTPS address. Scheme allowlists and denylists, the defence widely recommended after CVE-2025-6514 hit mcp-remote in 2025, do nothing to stop it. Pillar argues that the part of Anomaly’s patch that actually closed the hole was the dependency upgrade to open 11.0.4, which quotes the argument safely; the new URL scheme checks are useful defence in depth but would not have blocked this payload on their own. Second, the server does not need to be hostile on the day it is added. The payload arrives at connection time, so a server compromised later, a hijacked registry listing, a typosquatted name or an expired domain re-registered by someone else would all lead to the same result.
Pillar notes the same weakness already produced three CVEs in 2025, including CVE-2025-6514.
Why it matters for UK organisations
AI coding agents have moved from personal experiments to standard tooling in many UK development teams. Windows remains the default corporate laptop build in much of the UK, and WSL is a common way for those developers to run Linux toolchains. That is exactly the affected population.
A developer workstation is a high-value target. It typically holds source code, cloud credentials, signing keys, package registry tokens and access to CI/CD pipelines. Code execution there is a direct route into the software supply chain, which is the risk the NCSC has spent years urging organisations to take seriously.
The missing CVE is the operational problem. UK organisations generally build patch prioritisation around scanners, SBOM tooling and dependency bots, and all of them key off CVE identifiers and advisories. Without either, an unpatched OpenCode install looks clean. Teams that rely on asset inventories to evidence Cyber Essentials security update management will have nothing to flag unless they check versions by hand.
Expert view
The vendor’s position that hostile MCP servers are out of scope does not survive contact with how these tools are actually used. Any remote MCP endpoint is an outside party feeding data into a process that holds the developer’s privileges, which makes the MCP client a parser of untrusted input, in the same category as a browser or an email client, and it should be engineered on that basis.
When we test development environments, the weak points are rarely the shiny AI features themselves. They are the plumbing: dependency pins that nobody revisits, helper libraries handling strings they were never meant to trust, and configuration files that quietly point at external services. This bug is a textbook example of all three.
In my experience, silent fixes cause more lasting damage than the original flaw. A bug with a CVE gets triaged, tracked and closed. A bug fixed as a “refactor” lingers on every laptop where auto-update is off, and nobody knows to look. Vendors of AI agents need to accept that their products run code on behalf of people, and that brings the same disclosure obligations as any other software that does so.
What to do now
- Find every OpenCode install. Do not wait for a scanner alert, because none is coming. Check developer endpoints, WSL distributions and build images for the opencode-ai package and record its version (Cyber Essentials: security update management).
- Upgrade to 1.18.33 or later on Windows and WSL, and enforce it through your software deployment tooling rather than relying on developers.
- Prune remote MCP servers. Where an upgrade cannot happen immediately, remove unvetted remote MCP servers from agent configuration. Keep an approved list of MCP endpoints and treat additions like any other third-party integration (secure configuration).
- Hunt for the wider pattern. Search your own code and internal tools for remote or user-supplied strings passed to open 10.x or to shell commands. Upgrade the package and prefer argument-based process execution.
- Reduce the blast radius. Limit long-lived secrets on developer machines, use short-lived cloud credentials, and run coding agents under standard rather than administrative accounts (user access control).
- Watch PowerShell. Make sure endpoint detection covers unusual PowerShell activity spawned by Node.js processes on developer devices (malware protection).
Bottom line
The OpenCode flaw is fixed, but because nobody announced it, many organisations will stay exposed. Treat MCP servers as untrusted third parties, check AI agent versions directly, and do not assume a clean scanner report means an AI development tool is patched.
