What happened
Pillar Security disclosed on October 19, 2026 that the OpenCode AI coding agent, versions 1.0.137 to 1.18.32, would run attacker-supplied PowerShell on Windows and WSL when a developer signed in to a remote MCP server, because the sign-in web address chosen by the server was passed to a shell without escaping. OpenCode's maker fixed it quietly in 1.18.33 without a CVE or advisory, so vulnerability scanners won't flag old installs, The Hacker News reported on October 22. On October 21 the maintainers of MCP Inspector, the official MCP debugging tool, published advisories for the same flaw (fixed in 2.12.0) and a related callback bug in the 1.x line that works on any operating system (fixed in 1.0.3). (The Hacker News, Oct. 22, 2026)
Note on figures: The 9.8 severity score is Pillar Security's proposed rating, and the 3 million weekly downloads figure comes from Pillar; neither is an official CVE score.
What it means for Canada: our assessment
No Canadian victims have been reported. Canadian exposure is an assessment: any Canadian software team, bank or insurer engineering group, AI startup or agency whose developers use OpenCode or MCP Inspector on Windows or WSL and connect to outside MCP servers is exposed until those tools are updated.
- Sectors
- Software and SaaS firms · AI startups · Bank and insurer engineering teams · Digital and marketing agencies · Government IT and digital services
- Tools involved
- OpenCode (opencode-ai) 1.0.137 to 1.18.32 on Windows and WSL · MCP Inspector (@modelcontextprotocol/inspector) 2.0.0 to 2.11.0, and 1.x before 1.0.3 · Node.js tools that pass a remote server's URL to the open package below version 11
- Canadian rules
- PIPEDA: if a compromised developer machine leads to customer data exposure, report to the Privacy Commissioner when there is a real risk of significant harm
Quebec Law 25: record confidentiality incidents and notify the CAI where there is a risk of serious injury
OSFI B-13: federally regulated financial institutions must manage software and third-party technology risk, including developer tooling
Cyber Centre guidance on careful adoption of agentic AI: vet the external tools and servers agents connect to
Assessment, not documented exposure. The sources don't name affected Canadian organizations. Canadian firms are exposed because OpenCode is widely used (Pillar cites about 3 million weekly npm downloads) and Canadian developer teams commonly work on Windows or WSL and add third-party MCP servers to coding agents.
Takeaways for Canadian businesses
- BusinessUpgrade OpenCode (opencode-ai) to 1.18.33 or later on every Windows and WSL machine; check with opencode --version, since scanners won't flag old builds without a CVE.
- BusinessUpgrade MCP Inspector to 2.12.0, or 1.0.3 if you're still on the 1.x line, as the GHSA-q978-78c7-phqw and GHSA-4fc4-wcmh-4g86 advisories direct.
- BusinessRun opencode mcp list on developer machines and remove any remote MCP server that isn't on an approved list, as The Hacker News and Pillar advise.
- BusinessSearch internal Node.js tools for the open package below version 11 (npm ls open) where they open URLs supplied by remote servers, and upgrade it.
- BusinessIf a developer signed in to an unvetted MCP server on a vulnerable build, treat the machine as compromised, rotate the GitHub, cloud and AI API keys it held, and report it to the Canadian Centre for Cyber Security via My Cyber Portal or contact@cyber.gc.ca.
For the Canadian AI sector
This shows that simply connecting a coding agent to an MCP server, before any prompt or tool call, can hand over the developer's machine. Canadian AI teams building on MCP should treat remote MCP servers as untrusted code suppliers and keep an approved list.
Written by AgentsNorth from the source below. General information, not legal or security advice.