OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

10 hours ago [email protected] (The Hacker News)
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL


A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer’s Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer’s own access.

Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September

The post “OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL” appeared first on The Hacker News

Source:The Hacker News – [email protected] (The Hacker News)

Tags: ,

More Stories

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

3 hours ago [email protected] (The Hacker News)

INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown

7 hours ago [email protected] (The Hacker News)

The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat

9 hours ago [email protected] (The Hacker News)

Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation

10 hours ago [email protected] (The Hacker News)

LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release

13 hours ago [email protected] (The Hacker News)

New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification

14 hours ago [email protected] (The Hacker News)