Malicious MCP Servers Run Code Through OpenCode Sign-In Flow

Key Takeaways

• Pillar Security disclosed on October 19, 2026, that a remote MCP server could run code on OpenCode users' Windows and WSL machines.
• The code ran during MCP OAuth sign-in, through an outdated browser launch library.
• The fix in version 1.18.33 shipped without a CVE or advisory, so scanners will not flag exposed installs.
• Pillar rates it critical; no exploitation has been reported.

An OAuth Login Becomes a Shell Command

The Hacker News reported that OpenCode, a popular open-source AI coding agent, let a malicious or hijacked MCP server run code when a developer signed in to it. The quiet fix leaves many installs hard to find.

What We Know

Pillar Security reported the flaw to OpenCode's maintainer, Anomaly, on August 29, 2026. Anomaly fixed it on September 28 in version 1.18.33, inside a routine code change.

No CVE or advisory was issued. Infosecurity Magazine reported that Pillar published on October 19 and warned the quiet fix left users at risk.

Anomaly's policy treats user-added MCP servers as outside its trust boundary. Pillar reported no exploitation. The flaw is separate from the OpenCode Console breach already on the tracker.

What Could Happen

During OAuth sign-in, an MCP server tells the client where to send the user to log in. OpenCode passed that address to an old version of a browser launch library.

On Windows, that library built a PowerShell command around the address without escaping it. A crafted address could therefore run commands with the developer's privileges.

The developer had to add the server and start sign-in. But the server could be legitimate at first and hijacked later. macOS and Linux were not affected.

Why It Matters

Coding agents run on machines holding source code, SSH keys, and cloud and AI credentials. Code execution there is a direct path into an organization.

Without a CVE, scanners and dependency alerts cannot find vulnerable builds, so teams must check versions by hand.

The case shows MCP risk begins at connection time, before any tool is used. Server onboarding and client versions should be governed, not left to individual developers.

PointGuard AI Perspective

Every MCP server a developer adds becomes part of the attack surface, and risk can arrive during authentication. PointGuard AI helps govern that layer.

The MCP Security Gateway acts as a central policy enforcement point in front of MCP servers. Organizations decide which servers agents may reach and apply consistent authentication and inspection to every call.

PointGuard AI also maintains risk knowledge bases for MCP servers, scoring publisher trust and known vulnerabilities before developers connect.

Because this fix had no CVE, inventory matters more than scanning. AI discovery finds AI tools and MCP servers across repositories, IDEs, and runtime telemetry, and agentic endpoint security extends that view to developer workstations.

As MCP becomes the default way agents reach tools, every server connection should be a governed trust decision.

Incident Scorecard Details

Total AISSI Score: 6.20/10

Criticality: 7, Code execution on developer machines holding code and credentials. AISSI weighting: 25%

Propagation: 7, Any added MCP server, including one hijacked later, could deliver the payload. AISSI weighting: 20%

Exploitability: 4, Detailed public research, no observed exploitation. AISSI weighting: 15%

Supply Chain: 8, Open-source agent, outdated dependency, and third-party servers, with no CVE. AISSI weighting: 15%

Business Impact: 5, No confirmed harm, but a silent fix leaves exposure hard to find. AISSI weighting: 25%

Sources

Third-Party Sources

• The Hacker News: OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In
• Infosecurity Magazine: Researchers Warn OpenCode Quietly Patched Critical RCE Flaw

PointGuard AI Sources

• PointGuard AI MCP Security Gateway
• PointGuard AI Discovery
• PointGuard AI Agentic Endpoint Security