OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

The Hacker News · Thursday, 22 October 2026 at 10:44 (2h ago) · Original article ↗

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access.

Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September

You're reading a preview. The full article is published by The Hacker News on their website.

Read the full story on The Hacker News

Dev

Veteran ESA probe rolls out welcome mat for Japan's Phobos mission

Mars Express could support MMX's 2027 arrival as another 'last ever' extension keeps old spacecraft in flight

The Register 2h ago

Dev

Vercel Labs Open-Sources fx: A Zig Coding Agent Designed to Be Embedded

Vercel Labs has released fx, an experimental open-source coding agent written in Zig. It runs as a CLI, a script component, or an embedded library, including a WebAssembly build. Early feedback questioned its model-agnostic claim and a name conflict with an existing tool. Vercel…

InfoQ 3h ago

Dev

UK government hasn't the foggiest how much it's spending on digital transformation

Years of promises, but officials unable to put a figure on investment

The Register 3h ago

OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

More Software & Development

Veteran ESA probe rolls out welcome mat for Japan's Phobos mission

Vercel Labs Open-Sources fx: A Zig Coding Agent Designed to Be Embedded

UK government hasn't the foggiest how much it's spending on digital transformation