OpenCode flaw let malicious MCP servers run code at sign-in

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine at the moment the developer signed in, according to a report published by The Hacker News on 22 October 2026. Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33, which the report says was released in September.

OpenCode connects to MCP servers — Model Context Protocol servers, which are external services that supply an agent with extra tools — to extend what the coding assistant can do. According to the report, a server that was malicious from the outset, or a legitimate one that had been taken over, could abuse the sign-in process to execute code on the developer's machine. That code ran with the developer's own access, meaning it had whatever permissions the person signing in already had on their system.

The practical significance of that detail is straightforward. An agent that runs commands as the logged-in developer inherits that developer's reach: source code, local credentials, build tooling and anything else the account can touch. The report does not describe any specific data being taken, and does not name any affected organisation.

The affected platforms named in the report are Windows and Windows Subsystem for Linux, the compatibility layer that runs Linux environments inside Windows. The report does not say whether other operating systems were affected.

The weakness sits in a part of the agent stack that is growing quickly and is poorly understood by many of the developers using it. MCP servers are added to coding agents to give them capabilities the model does not have on its own, and each added server is a new piece of software with its own supply chain. A developer who installs a server from a public listing is, in effect, trusting whoever controls that listing and whoever can push updates to it. The reported flaw turned that trust decision into a code execution path that fired automatically during sign-in, rather than at a point where the developer was consciously approving an action.

The status of the issue is resolved. Developers running OpenCode should confirm they are on version 1.18.33 or later. Because the fix landed in a release rather than in a server-side change, users who have pinned an older version, or who installed the agent once and have not updated it since, would not have received it automatically.

The report does not say how the flaw was discovered, who reported it to Anomaly, or whether it was exploited before the fix shipped. Nor does it give a CVE identifier or a severity score. Anomaly's own description of the change beyond the version number is not included in the report.

For teams running agents that can execute commands locally, the episode is a reminder that the list of connected MCP servers is part of the attack surface, and that an agent's privileges are usually the privileges of the person who started it.