Pillar Security went public on October 19 with a critical flaw in OpenCode, Anomaly's coding agent: during OAuth login against a remote MCP server, the URL the server supplies ended up inside a PowerShell command unescaped. The patch shipped on September 28, but with no CVE and no security advisory.
How the Flaw Works
When a developer authenticates OpenCode against a remote MCP server that uses OAuth, it's the server itself that supplies the “authorization endpoint,” the URL the user is sent to. On Windows and WSL, OpenCode passed that URL to the open helper package to launch the browser. According to Pillar, that helper built a PowerShell command around the URL without escaping special characters; a URL crafted with PowerShell syntax would then run the command with the developer's privileges.
One important detail: the malicious payload can travel inside a seemingly normal HTTPS address, so the usual scheme check (http/https only) doesn't block it. What closed the hole was updating the library, not filtering the URL.
The Underlying Problem: A Patch With No Label
Pillar reported the finding privately on August 29 and disclosed it on October 19. Anomaly fixed it on September 28 in a change described as a browser-launch refactor; neither that change nor the release notes mention a vulnerability. According to the outlets that covered the case, the company responded that user-configured MCP servers sit “outside its trust boundary” and that a malicious server is outside its threat model.
The practical consequence: with no CVE, vulnerability scanners won't flag affected installs. Anyone relying only on a CVE-based inventory won't find out.
A Flaw With History
The root cause is a known one. The command-injection risk in the open package on Windows was reported in 2023 and fixed in its version 11; OpenCode had stayed on an earlier version. A very similar pattern already produced CVE-2025-6514 in the mcp-remote proxy in 2025. It's the same lesson as in other agent incidents: data handed over by a remote server (here, a URL) is treated as trusted and ends up in a command interpreter.
What to Do in a Company
1) Inventory who uses OpenCode on Windows or WSL and move everyone to 1.18.33 or later. 2) Run opencode mcp list and remove any remote MCP servers nobody has reviewed. 3) Maintain an approved list of MCP servers: a domain that changes hands or a compromised server can serve the malicious URL long after you added it. 4) Don't rely on CVEs alone: ask vendors of AI developer tools to communicate security patches as such.
Sources: Pillar Security (October 19 disclosure), The Hacker News, Infosecurity Magazine.