OpenCode vulnerability lets a malicious MCP server execute code at login on Windows and WSL

OpenCode AI coding agent has a vulnerability: a malicious or hijacked MCP server can execute code with the developer's privileges on their Windows or WSL machine when the developer logs in. Discovered by Pillar Security, rated critical, with a suggested score of 9.8/10. During login, the OAuth authorization endpoint address provided by the MCP server is spliced unescaped into a PowerShell command. It is triggered only when the developer runs opencode mcp auth to initiate login, and the attacker needs to control a remote MCP server the developer has already added. Anomaly fixed it on September 28 in version 1.18.33; affected versions are 1.0.137 through 1.18.32. The fix was released under the guise of refactoring the browser launch code, with no CVE requested and no security advisory published, so scanners will not flag builds that are still at risk. Anomaly says user-configured MCP servers are outside its trust boundary. macOS and Linux are not affected.