OpenCode MCP Code Execution Flaw — Detection, Patching to v1.18.33, and Hardening Guide

---
title: OpenCode Agent Spawning Shell or Script Interpreter
description: Detects the OpenCode AI coding agent spawning command shells or script interpreters, consistent with malicious MCP server-driven code execution at sign-in.
references:
  - https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/20
status: experimental
id: 4f8c2e71-9a3b-4d5e-b6f1-2c7d8e9a0b1c
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\opencode.exe'
      - '\opencode'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wsl.exe'
      - '\bash.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate MCP servers that execute developer-approved local tooling (e.g., build or test runners)
level: high
---
title: OpenCode MCP Configuration Modified Outside Expected Paths
description: Detects creation or modification of OpenCode/MCP configuration files by processes other than the OpenCode agent or the user's editor, indicating potential MCP server injection.
references:
  - https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/10/20
status: experimental
id: 8b3d1f62-4c5a-4e7b-9d2a-1f3e5c7b9d0a
tags:
  - attack.supply_chain_compromise
  - attack.t1195.002
  - attack.persistence
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - 'opencode.json'
      - '\.opencode\'
      - 'mcp.json'
      - 'mcp_settings'
  filter_legit:
    Image|endswith:
      - '\opencode.exe'
      - '\Code.exe'
      - '\code-insiders.exe'
      - '\notepad++.exe'
      - '\devenv.exe'
  condition: selection_path and not filter_legit
falsepositives:
  - Manual editing with non-listed editors; add your team's standard editors to the filter
level: medium
---
title: WSL Bash Execution Initiated by Windows-Side OpenCode
description: Detects OpenCode on Windows launching wsl.exe or bash.exe to execute commands inside WSL, matching the WSL-side execution path of this vulnerability.
references:
  - https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/10/20
status: experimental
id: 2e6a9c45-7d1f-4b8e-a3c6-5f9b2d4e7a1f
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\opencode.exe'
      - '\opencode'
  selection_exec:
    Image|endswith:
      - '\wsl.exe'
      - '\bash.exe'
  selection_args:
    CommandLine|contains:
      - '-e '
      - '--exec'
      - 'bash -c'
      - 'sh -c'
      - 'curl'
      - 'wget'
      - 'Invoke-'
      - 'base64'
  condition: selection_parent and selection_exec and selection_args
falsepositives:
  - Developer-approved MCP tooling that shells into WSL for builds; review CommandLine before tuning out
level: high

// Hunt: OpenCode spawning interpreters/downloaders and their network activity
let Lookback = 14d;
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wsl.exe","bash.exe","mshta.exe","rundll32.exe","curl.exe","wget.exe","certutil.exe","bitsadmin.exe"]);
let ProcEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName =~ "opencode.exe" or InitiatingProcessFileName =~ "opencode"
    | where FileName in~ (SuspiciousChildren)
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
              InitiatingProcessCommandLine, ProcessId, SHA256;
ProcEvents
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName in~ (SuspiciousChildren)
    | project DeviceName, InitiatingProcessId, RemoteUrl, RemoteIP, RemotePort, NetTime=TimeGenerated
) on $left.ProcessId == $right.InitiatingProcessId and $left.DeviceName == $right.DeviceName
| extend IsCloudOrCommonMcp = RemoteUrl has_any ("github.com","npmjs.com","anthropic.com","modelcontextprotocol") or isempty(RemoteUrl)
| where not(IsCloudOrCommonMcp) or ProcessCommandLine has_any ("base64","Invoke-","DownloadString","curl","wget","bash -c")
| summarize Executions = count(), DistinctRemoteHosts = dcount(RemoteIP)
    by DeviceName, AccountName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP
| order by Executions desc;

// Hunt: Suspicious shell execution inside WSL distributions
Syslog
| where TimeGenerated > ago(14d)
| where Computer has_any ("wsl","WSL") or Facility == "user"
| where SyslogMessage has_any ("bash -c", "sh -c", "curl |", "wget |", "base64 -d")
| extend CmdLine = extract(@"(?:bash|sh) -c ['\"]?(.*?)['\"]?$", 1, SyslogMessage)
| where isnotempty(CmdLine)
| summarize count() by Computer, CmdLine, bin(TimeGenerated, 1h)
| order by count_ desc;

-- Hunt: OpenCode child processes and recently modified MCP config artifacts
SELECT * FROM foreach(
  row={
    SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
    FROM pslist()
  },
  query={
    SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
           ParentName.Name AS ParentProcess
    FROM scope()
    JOIN (SELECT Pid AS PPid2, Name FROM pslist()) AS ParentName
    ON Ppid = ParentName.PPid2
    WHERE ParentProcess =~ '(?i)opencode'
      AND Name =~ '(?i)(cmd|powershell|pwsh|wsl|bash|mshta|rundll32|curl|wget|certutil)'
  })
UNION ALL
SELECT * FROM foreach(
  row={
    SELECT OSPath, Mtime, Size
    FROM glob(globs=[
      'C:/Users/*/.opencode/**',
      'C:/Users/*/AppData/*/opencode/**',
      'C:/Users/*/**/mcp.json',
      'C:/Users/*/**/opencode.json'
    ])
    WHERE Mtime > now() - 1209600  -- modified in last 14 days
  },
  query={
    SELECT NULL AS Pid, NULL AS Ppid, 'CONFIG_ARTIFACT' AS Name,
           OSPath AS CommandLine, NULL AS Exe, NULL AS Username,
           Mtime AS CreateTime, NULL AS ParentProcess
    FROM scope()
  })

# OpenCode MCP Flaw - Version Audit and MCP Config Inventory
$MinSafeVersion = [version]"1.18.33"
$report = @()

# Locate OpenCode installs (per-user and machine-wide)
$searchPaths = @(
    "$env:LOCALAPPDATA\Programs\opencode",
    "$env:ProgramFiles\opencode",
    "${env:ProgramFiles(x86)}\opencode",
    "$env:USERPROFILE\.opencode"
) | Where-Object { Test-Path $_ }

$opencodeExe = $searchPaths | ForEach-Object {
    Get-ChildItem -Path $_ -Recurse -Filter "opencode.exe" -ErrorAction SilentlyContinue
}

# Also check PATH resolution
if (-not $opencodeExe) {
    $cmd = Get-Command opencode -ErrorAction SilentlyContinue
    if ($cmd) { $opencodeExe = Get-Item $cmd.Source }
}

if (-not $opencodeExe) {
    Write-Output "[INFO] OpenCode not found on this host."
    exit 0
}

foreach ($exe in $opencodeExe) {
    $ver = [version]($exe.VersionInfo.ProductVersion -replace '[^0-9.]', '' -split '-' | Select-Object -First 1)
    $status = if ($ver -lt $MinSafeVersion) { "VULNERABLE - UPDATE TO 1.18.33+" } else { "PATCHED" }
    Write-Output "[$status] $($exe.FullName) - version $ver"
    $report += [pscustomobject]@{ Path = $exe.FullName; Version = $ver; Status = $status }
}

# Inventory MCP configuration for manual review
$configLocations = @(
    "$env:USERPROFILE\.opencode\opencode.json",
    "$env:APPDATA\opencode\opencode.json",
    "$env:USERPROFILE\opencode.json"
) | Where-Object { Test-Path $_ }

foreach ($cfg in $configLocations) {
    Write-Output "`n[REVIEW] MCP config found: $cfg"
    $content = Get-Content $cfg -Raw | ConvertFrom-Json -ErrorAction SilentlyContinue
    if ($content.mcp) {
        $content.mcp.PSObject.Properties | ForEach-Object {
            Write-Output "  MCP Server: $($_.Name) -> $($_.Value | ConvertTo-Json -Compress)"
        }
    }
}

if (($report | Where-Object { $_.Status -like 'VULNERABLE*' })) {
    Write-Output "`n[ACTION REQUIRED] Update OpenCode to 1.18.33 or later immediately."
    exit 1
}