OpenCode bug lets a bad MCP server start code on Windows

Pillar Security found a bug in the OpenCode coding agent and told the public on October 19. A bad MCP server (a connection to tools from other makers) can start code on a Windows or WSL (Windows Subsystem for Linux) computer when the developer signs in. Pillar gives the bug a top score of 9.8 out of 10.

How it works

During sign in, the server gives the web address that the user goes to. On Windows and WSL, OpenCode puts that address in a PowerShell command with no safe control. An address made to hold a command then starts it with the access of the developer. The attack needs a sign in.

The facts

Anomaly, the maker of OpenCode, repaired the bug in version 1.18.33 on September 28. Anomaly did not ask for a CVE (a public bug number) and did not write a notice. Versions 1.0.137 to 1.18.32 have the risk. macOS and Linux have no risk.

What is not known

Anomaly tells that an MCP server that a user adds is outside its trust limit. Pillar tells that Anomaly gave this answer when Pillar asked for a CVE. Pillar gave no list of signs of past attacks.

Insight: The vendor decides if a bug is public

Earlier in October 2026, a related MCP bug let a server take OAuth credentials. In July 2025, the mcp-remote proxy had an almost same bug. It seems that each vendor decides if a server bug gets a number, and scanners see only the bugs that get one. The version check is your only sure test.