OpenCode Vulnerability Allows Malicious MCP Servers to Execute Code During Sign-In

A security flaw in the OpenCode AI coding agent, developed by Anomaly, allowed a malicious or compromised MCP server to execute arbitrary code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to integrate external tools, and the malicious code would execute with the developer's own access privileges.

The vulnerability was discovered and reported in October 2026. Anomaly released version 1.18.33, which contains the fix for the flaw. The exact patch date and any CVE assignment remain unconfirmed at the time of reporting. No public CVE has been assigned.

The issue affects Windows and Windows Subsystem for Linux (WSL) machines where OpenCode is installed and connected to MCP servers. Exploitation requires the attacker to control or hijack an MCP server that the target OpenCode instance connects to during sign-in. Anomaly has not published an independent security advisory confirming the CVE status or full technical details beyond the version update.