2026-10-04 · 2026-Q4
opencode on Windows: A Malicious MCP Server's OAuth Endpoint Runs PowerShell Code on Connect
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
`opencode-ai` 1.0.137 through 1.18.32 on Windows and WSL
Impact
Pillar Security found that a remote MCP server could return an `authorization_endpoint` during OAuth discovery that opencode passed unvalidated to the `open` package. On Windows, `open` 10.1.2 built a PowerShell `-EncodedCommand` without escaping, so a `$(...)` inside an ordinary `https://` URL ran as code. Fixed in 1.18.33 (September 28, 2026) as a refactor with no advisory or CVE; Anomaly said malicious MCP servers are outside its threat model. Pillar proposes CVSS 9.8. Single source
Root cause
Server-supplied OAuth URLs handed to an OS launcher without scheme checks or escaping
Sources
Catalog
Cite this: AgentProv incident record: opencode on Windows: A Malicious MCP Server's OAuth Endpoint Runs PowerShell Code on Connect (2026-10-04). https://agentprov.com/incidents/2026-10-04-opencode-on-windows-a-malicious-mcp-server-s-oauth-endpoint-runs-powershell
Related
- Also L5 · 2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenL5Config
- Also L5 · 2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command ExecutionL5Config
- Also L5 · 2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)L5Config