Your developer didn’t install anything, click anything or fall for a prompt injection. Their AI coding agent simply tried to log in — and a remote server’s login link ran code on their machine.

In a write-up dated 19 October, Pillar Security disclosed a remote code execution flaw in opencode, an open-source AI coding agent it puts at roughly 3 million weekly npm downloads. On Windows and WSL, versions 1.0.137 to 1.18.32 took the authorization_endpoint that a remote Model Context Protocol (MCP) server supplies during OAuth discovery and handed it to the open browser-launcher package, which built a PowerShell command without escaping the URL. PowerShell expands $(…) inside double quotes, so an ordinary-looking https address carried the payload, with no additional user interaction or consent. Pillar proposes a CVSS score of 9.8. Anomaly, opencode’s developer, fixed it in 1.18.33 on 28 September but, according to Pillar, issued no advisory and requested no CVE, saying malicious MCP servers fall outside its threat model. The 1.18.33 release notes say only that MCP browser launch failures are now reported, and DigIntoAI, which checked the pull request and release notes, found that neither mentions security.

Two assumptions break here. The first is that a scheme check is enough. This bug class isn’t new: CVE-2025-6514, rated 9.6, covered command injection through the same authorization_endpoint field in mcp-remote in July 2025, and the usual fix since has been URL scheme validation. Pillar’s payload is plain https. It says what actually closed the hole in opencode was upgrading the open package to 11.0.4, not the new scheme checks. The second assumption is that our scanners will tell us. With no CVE there is nothing to match, so an unpatched agent on an engineer’s laptop looks clean on every vulnerability dashboard.

The deeper lesson is about trust. Pillar notes the server didn’t need to be malicious when it was added: a later compromise, a hijacked registry entry, a typosquat or an expired domain could deliver the same payload. Every MCP server your developers connect is untrusted input, parsed with their full privileges before the model ever sees it. For APAC teams that share repositories with regional development partners, those partners’ laptops and MCP server lists belong in your threat model too.

What security leaders should do:

• Inventory opencode directly on Windows and WSL endpoints and move anything from 1.0.137 to 1.18.32 to 1.18.33 or later. Don’t wait for a scanner finding that will never come.
• Where an upgrade can’t happen yet, remove remote MCP servers nobody has vetted, as Pillar advises.
• Keep an approved list of remote MCP servers with a named owner for each, and re-review it when domains or registry entries change hands.
• Require internal agent and MCP client builds to pass URLs as argument vectors, never through a shell, and to bind OAuth discovery to the configured server’s origin.
• Track AI developer tools by version in your asset inventory, not only through CVE feeds.

No CVE doesn’t mean no vulnerability. It means you’re the only one who will go looking.

Disclaimer: This post was researched and written by AI agents working with Philip Sow. Every source is linked so you can check the facts. Views are personal and do not represent any employer.

#AISecurity #AgenticAI #DevSecOps #APAC #CyberSecurity

Sources: Pillar Security · opencode v1.18.33 release notes (GitHub) · DigIntoAI · CVE.org: CVE-2025-6514