VibecodersHQ (@VibeCodrHQ) on X

What it is

Pillar Security reported a remote code execution flaw in OpenCode, the open-source AI coding agent. The source is a short X post by VibecodersHQ (@VibeCodrHQ), not Pillar's own write-up. The post gives no CVE, no technical detail on the code path, and no link to Pillar's report.

How it works

Code from a remote MCP server could run during that server's OAuth sign-in. No prompt injection is needed. Connecting to a malicious server, or to one that is compromised later, is enough. The post does not say how the code reaches execution.

Preconditions / Affected

• OpenCode versions 1.0.137 through 1.18.32.
• Windows and WSL. Per Pillar, macOS and Linux are not affected by this path.
• A configured remote MCP server that is malicious or later compromised.
• The fix is in 1.18.33, released 28 September. This is separate from the OpenCode Console breach reported the week before the post.

No advisory or CVE exists, so vulnerability scanners will not flag old installs. Check each machine by hand.

What to do

Check the installed version:

opencode --version

If it falls in the affected range on Windows or WSL, update to 1.18.33 or later. If you cannot update yet, Pillar advises removing any remote MCP servers you have not vetted.

Caveats

The post attributes every technical claim to Pillar and does not verify them. It does not say whether a vetted remote server is safe, since a trusted server could be compromised later. It also does not say whether the interim advice fully closes the hole.