OpenCode flaw allows malicious MCP servers to execute code on Windows and WSL

1. Executive summary

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in, executing with that developer's own access. Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 in September 2026. No CVE has been assigned, no CVSS score or severity has been published, and the issue is not listed in CISA KEV, so the exposure cannot be scored on the usual scales; the risk rests on where OpenCode runs and what the developer account can reach. For EMEA financial services the concern is developer endpoints and CI runners that hold repository, cloud and package-registry credentials, because code run at sign-in inherits all of them. Two related advisories in the same product class (ForgeCode and Language Servers for AWS) show the same trust-boundary failure recurring across AI coding tools, which makes this a pattern to manage rather than a one-off patch.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

OpenCode is an AI coding agent that connects to MCP (Model Context Protocol) servers to add outside tools. The flaw is in how OpenCode handles an MCP server at sign-in: a malicious or hijacked server could cause code to run on the developer's Windows or WSL machine during that sign-in, with the developer's own access. Anomaly fixed it in version 1.18.33 in September 2026.

Confirmed steps, as far as the source supports them:

A developer uses OpenCode configured to connect to an MCP server.
The MCP server is malicious, or a legitimate one has been hijacked.
The developer signs in to OpenCode.
Code from the MCP server runs on the developer's Windows or WSL machine with the developer's privileges.

The source does not describe the exact mechanism (whether the server supplies a command, an argument list, or a tool definition that OpenCode executes), the transport used to reach the MCP server, or whether any user confirmation is shown. Those gaps matter for detection and are not filled here.

The impact follows from the privilege context. Code run at sign-in inherits the developer's access: repository credentials, cloud CLI sessions, package-registry tokens, SSH keys and any secrets in the developer's environment. On WSL the same applies inside the Linux environment, which often holds separate credentials from the Windows host. The source does not state whether the code runs before or after authentication completes, so whether an unauthenticated server can trigger execution is unknown.

Two related advisories show the same class of failure in neighbouring tools. ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json on startup without user confirmation; a crafted .mcp.json with mcpServers entries specifying arbitrary command and args values (for example command: bash with args: ['-c', 'touch /tmp/pwned']) is spawned with the invoking user's privileges when the CLI runs inside a cloned untrusted repository. Language Servers for AWS (the runtime behind Amazon Q Developer's IDE plugins for VS Code, JetBrains, Eclipse and Visual Studio) had improper trust boundary enforcement below version 1.65.0: opening and trusting a maliciously crafted workspace could let commands in project-level configuration files run automatically. Both are fixed (ForgeCode per its advisory; Language Servers for AWS in 1.65.0, with no workarounds). Neither is the OpenCode flaw, but together they establish that AI coding tools which auto-load project or server configuration are a repeatable initial-access and persistence path against developers.

Confidence caveats. The OpenCode detail rests on a single source (The Hacker News), which is itself summarising Anomaly's fix; the primary vendor advisory was not available for this note, so the affected version range below 1.18.33, the exact trigger and any preconditions are single-sourced and should be verified against Anomaly's release notes before enforcement. No CVE, CVSS score, EPSS estimate or CISA KEV entry exists for this item, so severity is unrated rather than low. No actor, campaign or exploitation in the wild is attributed in the source; any attribution would be unconfirmed.

4. Mitigation & containment

P1 (within 24h)

Inventory OpenCode installs across developer endpoints and CI runners and upgrade every instance to 1.18.33 or later. Treat any version below 1.18.33 as exposed.
Identify which MCP servers each OpenCode instance connects to and remove or disable any that are not on an approved list. A hijacked legitimate server is in scope, so review server provenance, not just whether a server is known.
On endpoints that ran an unapproved MCP server, rotate credentials reachable from the developer's Windows and WSL contexts: repository tokens, cloud CLI sessions, package-registry tokens and SSH keys.

P2 (within 72h)

Restrict developer endpoints and CI runners from reaching arbitrary MCP servers; allow only approved hosts at the egress proxy or firewall.
Apply the same control to the related tools: upgrade Language Servers for AWS to 1.65.0 or later, and review ForgeCode's handling of .mcp.json in untrusted repositories (block auto-execution or require confirmation).
Add detection for OpenCode spawning child processes at sign-in (see §6) and alert on it.

P3 (within 7 days)

Add MCP server configuration to code review and endpoint baselining so new servers are approved before use.
Where developers clone untrusted repositories, require a separate low-privilege account or isolated environment for evaluation, so a malicious .mcp.json or workspace config cannot reach production credentials.

5. Indicators of compromise

No indicators of compromise available in the source material. The source gives no hashes, domains, IPs, file paths or server names. The related advisories give behavioural detail only (auto-execution of .mcp.json mcpServers entries; execution of commands in trusted workspace configuration), which is captured below rather than as atomic indicators.

Behavioural indicators

behaviour	where to observe	confidence
OpenCode spawns a child process during sign-in	EDR process telemetry on Windows and WSL, correlated to OpenCode sign-in events	medium (single-sourced)
OpenCode connects to an MCP server not on the approved list	Egress proxy / firewall logs, OpenCode configuration	medium
ForgeCode spawns `bash -c` from a repository `.mcp.json` on startup	EDR process telemetry, CLI startup	high (vendor advisory)
Language Servers for AWS executes commands from trusted workspace configuration	IDE/editor process telemetry, version below 1.65.0	high (vendor advisory)

6. Detection

The source gives no file artefacts, command-line flags, mutexes or paths specific to the OpenCode flaw, so a YARA rule would have nothing genuine to match and is not emitted. The Sigma rule below targets the behavioural signal: OpenCode spawning a shell or interpreter child process, which is the observable consequence of the flaw. Tune the parent image and child list to your estate.

title: OpenCode spawning shell or interpreter child process
id: 8f3c2a10-1470-4b7e-9c1d-0a2b3c4d5e6f
status: experimental
description: Detects the OpenCode AI coding agent spawning a shell or interpreter, consistent with code execution via a malicious or hijacked MCP server at sign-in.
author: Adverse Trace
date: 2026-10-22
references:

  - https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:

      - '\opencode.exe'
      - '\opencode'
  selection_child:
    Image|endswith:

      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bash.exe'
      - '\wsl.exe'
      - '\python.exe'
      - '\node.exe'
  condition: selection_parent and selection_child
falsepositives:

  - Legitimate MCP tools that invoke a shell or interpreter as part of normal operation
level: medium

For WSL, collect process creation inside the Linux environment (auditd or eBPF) and match on the OpenCode binary as parent with bash, sh, python3 or node as child.

7. Sources

The Hacker News, "OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL", https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html, 2026-10-22.
GitHub Security Advisories, "ForgeCode (tailcallhq/forgecode) automatically loads and executes MCP servers from .mcp.json", https://github.com/advisories/GHSA-6p2j-g97c-79wf, date not stated in source.
GitHub Security Advisories, "Language Servers for AWS Vulnerable to Arbitrary Code Execution", https://github.com/advisories/GHSA-xhcr-j4j9-3gh7, date not stated in source.

8. Adverse Trace position

Adverse Trace assesses this as an unrated exposure: no CVE, no CVSS score, no EPSS estimate and no CISA KEV entry exist, so we do not assign a severity the data cannot support, and we treat the OpenCode detail as single-sourced pending Anomaly's own advisory. The client impact is concentrated in developer endpoints and CI runners that hold repository, cloud and registry credentials, where code run at sign-in inherits everything the developer can reach. We will obtain and review Anomaly's release notes to confirm the affected version range and trigger, track whether a CVE is assigned, and update this advisory if either changes. Clients running OpenCode should confirm their version is 1.18.33 or later and send us their MCP server inventory for review.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.