Pillar Security: OpenCode on Windows ran attacker code when a remote MCP server started OAuth
What happened
Pillar Security reported that OpenCode versions 1.0.137 to 1.18.32 on Windows and WSL could run arbitrary commands when connecting to a remote MCP server that supplied a crafted OAuth authorization URL. The flaw was fixed in version 1.18.33. No exploitation in the wild was reported.
Pillar says a server-supplied OAuth authorization URL reached the open package, which on Windows passes it to PowerShell without correct quoting, so an embedded command could run when OpenCode connected to a remote MCP server. Only Windows and WSL are affected. Pillar rated the issue critical and reported it privately at the end of August 2026.
How it happened
Manipulated AI: Tool poisoning. A malicious tool or tool description hijacked an AI agent that trusted it.
The software involved works with many AI models, so no single model maker was involved. The product was OpenCode, which is open source, a type of coding assistant.
Impact
Data was exposed. Data involved: unknown. There is no evidence that anyone actually accessed the data.
Severity is rated Low, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm. This was a research finding: no real victims are known.
It became public on 19 Oct 2026.
The vendor, Anomaly, released version 1.18.33 on 28 September with URL scheme checks, without a CVE or security advisory. Pillar argues the real fix is a newer version of the open package that quotes the target correctly. Anomaly told Pillar that malicious MCP servers are outside its threat model.