Opening SecureFlowOpenCode: An MCP OAuth URL Reaches the Windows Shell
Case summary & sources

AIDEFEND SecureFlow / SecureFlow Case Index

Pillar Security aidefend-sf0073

OpenCode: An MCP OAuth URL Reaches the Windows Shell

  • Autonomous Agents
  • System Compromise & RCE

Pillar Security demonstrated code execution in OpenCode, an AI coding agent, during remote MCP OAuth authentication on Windows and WSL. A server-controlled HTTPS authorization URL reached an unsafe browser-launch command and was interpreted by PowerShell. The model did not need to follow a prompt. OpenCode 1.18.33 fixed the affected launch dependency; the disclosure reports no CVE assignment.

Mapped threat techniques

  • AML.T0050 Command and Scripting Interpreter

Source

Updated