A critical vulnerability in open-source agentic AI coding tool OpenCode has been silently patched, leaving users running vulnerable versions unaware of the risk, security researchers have warned.
OpenCode is a widely used AI agent platform designed for software developers. It has over 218,000 stars on GitHub.
In a new report released on October 19, Eilon Cohen, head of security research at Pillar Security, disclosed a critical remote code execution (RCE) vulnerability affecting OpenCode versions 1.0.137 to 1.18.32.
The flaw reportedly affects Windows and Windows Subsystem for Linux (WSL). If exploited, it could allow an attacker-controlled remote model context protocol (MCP) server to execute arbitrary code on a developer’s machine during an MCP OAuth authentication process, without additional user interaction or consent.
The Pillar Security team reported the vulnerability privately via GitHub Security Advisory with full reproduction material at the end of August 2026.
A month later, Anomaly, the company behind OpenCode, confirmed it had received the report, but said malicious MCP servers are “outside their threat model.”
Pillar Security researchers said Anomaly patched the vulnerability on September 28 in version 1.18.33 – without a CVE or security advisory.
“As a result, conventional vulnerability scanners and dependency alerts will not identify affected installations, potentially leaving enterprises unaware that they need to upgrade,” Pillar Security researchers warned.
URL Validation Falls Short of Preventing OpenCode RCE Attacks
Pillar Security researchers claimed that the standard fix isn’t enough to fully remediate this vulnerability, which they assessed should be allocated a critical severity rating (CVSS) of 9.8.
According to the researchers, URL scheme validation alone cannot prevent the attack because the malicious payload can be embedded in a seemingly legitimate HTTPS URL.
On Windows, the vulnerable open dependency passed the URL to PowerShell without properly escaping it, allowing the shell to interpret part of the URL as a command.
Although OpenCode added URL scheme checks in version 1.18.33, the researchers said the crucial fix was to update the dependency to a version that correctly quotes the URL, preventing PowerShell from interpreting the payload as executable code.
They recommend that developers avoid passing untrusted URLs through shell commands altogether, instead using argument-based process execution to reduce the risk of command injection.
OpenCode RCE Flaw Unrelated to Recent Console Security Breach
This vulnerability report comes a few days after OpenCode confirmed a security breach affecting its Console, which allows teams to share access to AI models through centrally managed API credentials.
Speaking to Infosecurity, Pillar Security’s Cohen stressed that this newly disclosed vulnerability was not related to the Console breach.
“The breach hit a legacy system behind a hosted key proxy, and exposed provider keys users had stored there. The vulnerability we reported runs the other way: a malicious remote MCP server executing code on a developer's own machine during the OAuth handshake. Different target and attacker position,” he explained.
Nevertheless, Cohen highlighted that both incidents come down to the same thing, “Who you let hand credentials and inputs to an AI coding tool, and what that tool does with them.”