# OpenCode Flaw Lets Malicious MCP Servers Run Code During Sign-In

A security flaw in OpenCode allows malicious MCP servers to execute code on Windows and WSL during the sign-in process. The issue matters because developers using MCP integrations could be compromised by connecting to an untrusted server. Users should update OpenCode or avoid untrusted MCP servers until a fix is applied.

**Importance:** 3/5

## Sources

### Security
- [The Hacker News](https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html) — Thu, 22 Oct 2026 16:14:05 +0530