TL;DR: Security firm Pillar Security says OpenCode on Windows and WSL had a critical flaw: a remote MCP server you connected could run code on your machine during the automatic MCP OAuth sign-in. Versions 1.0.137 to 1.18.32 are affected. OpenCode’s developer, Anomaly, fixed it in 1.18.33 on Sept 28, 2026, but published no security advisory and no CVE, so vulnerability scanners and dependency alerts won’t flag it. If you use OpenCode on Windows or WSL, update now.

What happened

Pillar Security research dated Oct 19, 2026, describes a remote code execution flaw in OpenCode (the opencode-ai package on npm) that affects Windows and Windows Subsystem for Linux (WSL).

When a remote MCP server asks for authorization, OpenCode runs an OAuth sign-in and opens the login address the server supplies. Pillar found that on Windows this address was passed to PowerShell without escaping, so a server could hide a command inside an ordinary-looking https:// link and have it run on your machine, with no further clicks or consent. Pillar says the attack needs no malware install and no prompt injection.

Pillar also notes that the server doesn’t have to be malicious when you first add it. Because the payload arrives when OpenCode connects, a server that is later compromised, or a lookalike or expired domain, could trigger the same path.

Pillar says macOS and Linux are not affected, because the browser launcher on those systems doesn’t pass the address through a shell.

Pillar rates the flaw 9.8 (Critical) using its own proposed CVSS score. That is Pillar’s rating, not an official one, since no CVE exists.

The fix, and why scanners miss it

According to Pillar, Anomaly merged the fix on Sept 25, and it shipped in OpenCode 1.18.33, released Sept 28, 2026. The 1.18.33 release notes don’t mention security. The closest line is “MCP browser launch failures are now reported when the launcher exits immediately.”

Pillar says Anomaly told it that malicious MCP servers are outside OpenCode’s threat model, and that Anomaly didn’t request a CVE. Without a CVE or advisory, there’s nothing for vulnerability scanners or tools like dependency bots to match, so affected installs won’t show up in those reports.

What to do

  1. Check your version. On each Windows or WSL machine where you use OpenCode, check which version is installed. Anything from 1.0.137 to 1.18.32 is affected.
  2. Update to 1.18.33 or later. This is the fix Pillar recommends. If your team manages OpenCode installs, check each machine directly, since scanners won’t list it.
  3. Review the MCP servers you’ve connected. Remove remote MCP servers you don’t recognize or trust from your OpenCode configuration. If you can’t update right away, Pillar advises removing unvetted remote MCP servers until you can.

This is separate from the OpenCode Console breach over the weekend. If you linked provider keys to OpenCode Console, see our coverage of that breach and what to check.

Sources & method

Sources

Method. Last checked October 19, 2026. We read Pillar Security’s research and the OpenCode 1.18.33 release notes. The affected versions, platforms, severity rating and Anomaly’s response come from Pillar; the release date comes from GitHub. Anomaly hasn’t published its own advisory. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.