// tag
Security incidents tagged OpenCode. Newest first.
› OpenCode AI coding agent (Anomaly) on Windows and WSL
A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported.
› OpenCode Console (hosted service by Anomaly)
On the night of Oct 16 2026 an intruder reached a legacy OpenCode Console system that was being decommissioned and may have exposed third-party AI provider keys saved in Console workspaces. OpenCode says 1.4% of Console users (those with external providers linked) were affected and tied it to a large-scale distillation attack. Users reported unauthorized charges up to ~$1,700 and some Google Cloud project suspensions. Anthropic and Google revoked/blocked exposed keys; OpenAI refunded drawn credits. The OpenCode app itself (local keys) was not affected.
🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in. Fixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions. What developers need to know: t.co/l6N4LCjhWt
they've been non stop trying to attack our systems for the past 48 hours a side effect is everything is getting hardened but damn we basically need agents going 24/7 because that's what they have
@lydiahallie note this is the OpenCode Console, not OpenCode itself, those keys never come to us
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers
