OpenCode Flaw Lets Malicious MCP Servers Execute Code During SignIn on Windows and WSL

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developers Windows or WSL machine when the developer signed in OpenCode connects to MCP Model Context Protocol servers to add outside tools and such code would run with the developers own access Anomaly the company behind OpenCode fixed the flaw in version 11833 on September