OpenCode flaw let malicious MCP servers run code at sign-in on Windows and WSL

Past-week coverage · Original source published 2026-10-22.

A flaw in the OpenCode AI coding agent let a malicious or hijacked MCP server run code on a developer's Windows or WSL machine when that developer signed in, according to a report published October 22, 2026.

OpenCode connects to MCP (Model Context Protocol) servers to add outside tools. The code that ran in this case would have run with the developer's own access, which is the part that matters: an MCP server is meant to supply tools, not to execute commands on the host.

Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33, the report says. The retained source does not describe the technical root cause, the affected version range, or whether anyone exploited the issue in the wild, so those details should not be assumed.

Why it matters

AI coding agents increasingly sit inside developer environments with the same permissions as the person using them. A compromised or untrustworthy MCP server therefore inherits that reach. Teams that let developers add MCP servers on their own should treat the server list as part of the attack surface.

What defenders can do

• Check which OpenCode version is installed and move to 1.18.33 or later, per the vendor's fix.
• Review which MCP servers are configured and who added them.
• Limit what credentials and repositories a developer session can reach, so a rogue tool has less to work with.

The report does not say whether the flaw was disclosed privately or publicly, or how it was found.