importantSYS.SOURCE: The Hacker News• 2026-10-22T16:14:05+05:30

Critical Vulnerability in OpenCode AI Agent Allows Code Execution via Malicious MCP Servers

#ai #vulnerability #code-execution

A vulnerability in the OpenCode AI coding agent enabled malicious MCP servers to execute arbitrary code on Windows and WSL machines during user sign-in. The issue was resolved in version 1.18.33 released on September 2026.

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access.

Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September

Read original article

*** END OF TRANSMISSION ***

> TESLA EXPANDS CYBERCAB DEPLOYMENT AMID REGULATORY AND MARKET CHALLENGES > SPOTIFY ENHANCES FAMILY PLAN VERIFICATION WITH QR CODE SYSTEM, CALLS IT ROUTINE UPDATE > STRATEGIES FOR RAISING A SERIES A IN THE CURRENT VENTURE MARKET > SPOTIFY'S AI STRATEGY FOCUSES ON BECOMING THE PREFERRED MUSIC SERVICE FOR AI AGENTS > HELION DEVELOPS ADVANCED SEMICONDUCTORS TO ENHANCE FUSION POWER PLANT EFFICIENCY > QUAD9 DNS RESOLVER CEASING OPERATIONS IN FRANCE DUE TO LEGAL RULING > CANADIAN MPS PROPOSE BILL TO RESTRICT GAMBLING ADVERTISING AMID RISING PUBLIC HEALTH CONCERNS > LIVE SECURITY INCIDENT TRACKER: VULNERABILITIES AND EXPLOITS > RAILWAY DEVELOPER PLATFORM ISSUES MANDATORY SECRET KEY REVOCATION FOLLOWING CYBERATTACK > ANTHROPIC LAUNCHES CLAUDE DUET AI AGENT FOR BUSINESS AUTOMATION> TESLA EXPANDS CYBERCAB DEPLOYMENT AMID REGULATORY AND MARKET CHALLENGES > SPOTIFY ENHANCES FAMILY PLAN VERIFICATION WITH QR CODE SYSTEM, CALLS IT ROUTINE UPDATE > STRATEGIES FOR RAISING A SERIES A IN THE CURRENT VENTURE MARKET > SPOTIFY'S AI STRATEGY FOCUSES ON BECOMING THE PREFERRED MUSIC SERVICE FOR AI AGENTS > HELION DEVELOPS ADVANCED SEMICONDUCTORS TO ENHANCE FUSION POWER PLANT EFFICIENCY > QUAD9 DNS RESOLVER CEASING OPERATIONS IN FRANCE DUE TO LEGAL RULING > CANADIAN MPS PROPOSE BILL TO RESTRICT GAMBLING ADVERTISING AMID RISING PUBLIC HEALTH CONCERNS > LIVE SECURITY INCIDENT TRACKER: VULNERABILITIES AND EXPLOITS > RAILWAY DEVELOPER PLATFORM ISSUES MANDATORY SECRET KEY REVOCATION FOLLOWING CYBERATTACK > ANTHROPIC LAUNCHES CLAUDE DUET AI AGENT FOR BUSINESS AUTOMATION