MCP startup path as RCE: opencode OAuth flaw and Copilot CVE-2026-103572

A CSA research note analyzes two remote code execution vulnerabilities in AI coding tools disclosed in October 2026; the common factor is that attacker-controlled data reaches the process-spawning code of an MCP integration. Pillar Security researcher Eilon Cohen found that in opencode 1.0.137 through 1.18.32 on Windows and WSL, a remote MCP server could inject a PowerShell subexpression into the OAuth authorization endpoint, which executes when the client opens the browser to log in; version 1.18.33 fixed it by upgrading the open package. The vendor did not request a CVE and said malicious MCP servers are outside its threat model. The note recommends upgrading opencode to 1.18.33 or higher and applying the October 2026 Visual Studio security update, because the opencode fix has no CVE and is hard for scanners to flag, so versions must be checked directly, and MCP launch configurations should be treated as executable code.