Research

OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

Why it matters: A flaw in the OpenCode AI coding agent let a malicious or hijacked MCP server run code with the developer's access during sign-in on Windows and WSL, so users should update to version 1.18.33.

Covered by 1 outlet

  • The Hacker News - OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL ()

Published

Start with real signal

See your security surface before you subscribe.

Run the complete AYAsec workflow on Free, then move to the cadence your team needs.

Start scanning free