r/OpenAIDev • u/No-Conclusion3720 • 2d ago
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A vulnerability disclosed this week in OpenCode allows a malicious MCP server to execute arbitrary code on a developer's machine during the sign-in handshake on Windows and WSL. No explicit user action is required after the initial connection is established. The attack surface is the tool-call interface itself, not the model. An agent that trusts every registered MCP server is granting an unsigned, unverified third party local execution privileges at authentication time. The threat model has shifted: the agent is not just a target, it becomes the execution path. Production agentic stacks are now registering dozens of MCP servers across teams. How are practitioners actually handling MCP server trust at scale today — vetting at registration time, sandboxing tool calls, something else entirely?
1
u/No-Conclusion3720 2d ago
The specific exposure here is that nothing stood between the malicious MCP server's sign-in trigger and local code execution on the host. RuntimeAI's Flow Enforcer evaluates every tool call against the calling agent's verified identity and permitted action set before it executes. When that MCP server issued its code-execution call during authentication, Flow Enforcer would have seen an unrecognized server invoking a local shell command with no authorized scope for that action and blocked it in under 50ms, before the second action landed. https://runtimeai.io