{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:23:59.585Z",
  "tag": {
    "id": "opencode",
    "label": "OpenCode",
    "isStack": false,
    "url": "https://pwn.watch/t/opencode",
    "feed": "https://pwn.watch/t/opencode/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 2,
    "notFullyPatched": 1,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "opencode-mcp-oauth-rce-windows",
      "title": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows",
      "json": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "OpenCode AI coding agent (Anomaly) on Windows and WSL",
      "tags": [
        "ai",
        "devtools",
        "windows",
        "opencode",
        "mcp"
      ],
      "cveIds": [],
      "affectedVersions": [
        "OpenCode 1.0.137 through 1.18.32 on Windows and WSL"
      ],
      "fixedVersions": [
        "OpenCode 1.18.33"
      ],
      "startedAt": "2026-10-19",
      "closedAt": null,
      "updatedAt": "2026-10-22T16:00:44+02:00",
      "summary": "A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported.",
      "xPost": null
    },
    {
      "slug": "opencode-console-provider-key-breach",
      "title": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys",
      "url": "https://pwn.watch/i/opencode-console-provider-key-breach",
      "json": "https://pwn.watch/i/opencode-console-provider-key-breach.json",
      "status": "live",
      "severity": "high",
      "patchStatus": "partial",
      "product": "OpenCode Console (hosted service by Anomaly)",
      "tags": [
        "ai",
        "opencode",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [
        "OpenCode Console workspaces with saved OpenAI, Anthropic or Google provider keys (~1.4% of Console users; affected users were emailed)"
      ],
      "fixedVersions": [],
      "startedAt": "2026-10-17T00:30:00Z",
      "closedAt": null,
      "updatedAt": "2026-10-22T16:32:37+02:00",
      "summary": "On the night of Oct 16 2026 an intruder reached a legacy OpenCode Console system that was being decommissioned and may have exposed third-party AI provider keys saved in Console workspaces. OpenCode says 1.4% of Console users (those with external providers linked) were affected and tied it to a large-scale distillation attack. Users reported unauthorized charges up to ~$1,700 and some Google Cloud project suspensions. Anthropic and Google revoked/blocked exposed keys; OpenAI refunded drawn credits. The OpenCode app itself (local keys) was not affected.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "The Hacker News",
      "handle": "TheHackersNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg",
      "text": "🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in.\n\nFixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions.\n\nWhat developers need to know: https://t.co/l6N4LCjhWt",
      "date": "2026-10-22T10:44:40.000Z",
      "url": "https://x.com/TheHackersNews/status/2113219984365359340",
      "media": [],
      "incident": "opencode-mcp-oauth-rce-windows"
    },
    {
      "authorName": "dax",
      "handle": "thdxr",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1602333093485891584/mmVqjFNI_bigger.jpg",
      "text": "they've been non stop trying to attack our systems for the past 48 hours\n\na side effect is everything is getting hardened but damn we basically need agents going 24/7\n\nbecause that's what they have",
      "date": "2026-10-18T12:04:27.000Z",
      "url": "https://x.com/thdxr/status/2111790511409258796",
      "media": [],
      "incident": "opencode-console-provider-key-breach"
    },
    {
      "authorName": "dax",
      "handle": "thdxr",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1602333093485891584/mmVqjFNI_bigger.jpg",
      "text": "@lydiahallie note this is the OpenCode Console, not OpenCode itself, those keys never come to us",
      "date": "2026-10-17T21:38:37.000Z",
      "url": "https://x.com/thdxr/status/2111572618340188393",
      "media": [],
      "incident": "opencode-console-provider-key-breach"
    },
    {
      "authorName": "OpenCode",
      "handle": "opencode",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1973794620233433088/nBn75BTm_bigger.png",
      "text": "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users\n\nWe have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers",
      "date": "2026-10-17T18:08:06.000Z",
      "url": "https://x.com/opencode/status/2111519637049319818",
      "media": [],
      "incident": "opencode-console-provider-key-breach"
    }
  ],
  "changes": [
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "The Hacker News reports the flaw; upgrade to 1.18.33, run `opencode mcp list`, and remove unvetted remote MCP servers.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    },
    {
      "incident": "opencode-console-provider-key-breach",
      "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "Anthropic credit restoration still in progress; OpenCode says it will cover them itself if not done this week.",
      "body": null,
      "sourceUrl": "https://ctxsec.com/items/opencode-console-provider-key-breach-2026-10",
      "url": "https://pwn.watch/i/opencode-console-provider-key-breach"
    },
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-19",
      "title": "Pillar Security discloses the flaw publicly. Anomaly declined to request a CVE, saying user-configured MCP servers are outside its trust boundary.",
      "body": null,
      "sourceUrl": "https://x.com/Pillar_sec/status/2112166888985722937",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    },
    {
      "incident": "opencode-console-provider-key-breach",
      "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-19",
      "title": "BleepingComputer and The Hacker News report unauthorized charges up to ~$1,700 and Google Cloud project suspensions; OpenAI says it refunded affected credits.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html",
      "url": "https://pwn.watch/i/opencode-console-provider-key-breach"
    },
    {
      "incident": "opencode-console-provider-key-breach",
      "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-18",
      "title": "Dax says attackers have been 'non stop' attacking OpenCode's systems for 48 hours; systems being hardened.",
      "body": null,
      "sourceUrl": "https://x.com/thdxr/status/2111790511409258796",
      "url": "https://pwn.watch/i/opencode-console-provider-key-breach"
    },
    {
      "incident": "opencode-console-provider-key-breach",
      "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-17T00:30Z",
      "title": "Earliest possible exposure of saved provider keys (per OpenCode's email to affected users).",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html",
      "url": "https://pwn.watch/i/opencode-console-provider-key-breach"
    },
    {
      "incident": "opencode-console-provider-key-breach",
      "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-17",
      "title": "OpenCode emails affected users, then announces the breach on X, tied to a 'large scale distillation attack' affecting 1.4% of Console users.",
      "body": null,
      "sourceUrl": "https://x.com/opencode/status/2111519637049319818",
      "url": "https://pwn.watch/i/opencode-console-provider-key-breach"
    },
    {
      "incident": "opencode-console-provider-key-breach",
      "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-17",
      "title": "Dax (OpenCode) clarifies only the hosted Console is affected; keys used locally with the OpenCode app never reach OpenCode. Anthropic and Google revoke/block exposed keys; refunds start.",
      "body": null,
      "sourceUrl": "https://x.com/thdxr/status/2111572618340188393",
      "url": "https://pwn.watch/i/opencode-console-provider-key-breach"
    },
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-09-28",
      "title": "OpenCode 1.18.33 ships the fix as a routine browser-launch refactor; release notes don't mention security.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    },
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-08-29",
      "title": "Pillar Security privately reports the flaw to Anomaly.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    }
  ]
}