A flaw in the OpenCode AI coding agent permitted malicious or hijacked MCP servers to execute code on a developer's Windows or WSL machine during sign-in.
This vulnerability allowed arbitrary code execution with the developer's own access privileges. OpenCode utilizes MCP servers to integrate external tools.
Anomaly, the company behind OpenCode, has addressed this security issue by releasing version 1.18.33, which fixes the flaw.
Sources and references
Original report
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 00EZ8UGC
Cite this
APA
Interestana AI Editorial. (2026, October 22). OpenCode AI Flaw Allows Code Execution on Sign-In. Interestana. https://interestana.com/articles/opencode-flaw-lets-malicious-mcp-servers-execute-code-during-sign-in-on-windows-and-wsl-00ez8ugc
MLA
“OpenCode AI Flaw Allows Code Execution on Sign-In.” Interestana, 22 Oct. 2026, interestana.com/articles/opencode-flaw-lets-malicious-mcp-servers-execute-code-during-sign-in-on-windows-and-wsl-00ez8ugc.
Chicago
Interestana AI Editorial. “OpenCode AI Flaw Allows Code Execution on Sign-In.” Interestana, October 22, 2026. https://interestana.com/articles/opencode-flaw-lets-malicious-mcp-servers-execute-code-during-sign-in-on-windows-and-wsl-00ez8ugc.
BibTeX
@misc{interestana_00ez8ugc,
author = {{Interestana AI Editorial}},
title = {{OpenCode AI Flaw Allows Code Execution on Sign-In}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/opencode-flaw-lets-malicious-mcp-servers-execute-code-during-sign-in-on-windows-and-wsl-00ez8ugc},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html}
}Credit the source
Original reporting: The Hacker News, “OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL”, https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html(opens in a new tab)
Follow this story
Get Artificial Intelligence in your inbox — new stories in 40 words or fewer, once a week.
Subscribe