Daily Frontier Digest ·
OpenCode let a malicious MCP server run commands on Windows and WSL during sign-in, and fixed it without an advisory
Curated by Alfredo Borrás · Plymouth AI Lab
A sign-in bug in OpenCode let a remote MCP server run code on Windows and WSL machines and shipped without a CVE, Claude Code closes several sandbox gaps, OpenClaw now refuses unpatched Node, and inclusionAI releases an MIT-licensed healthcare model.
The story today
OpenCode let a malicious MCP server run commands on Windows and WSL during sign-in, and fixed it without an advisory
When a developer signs in to a remote MCP server from OpenCode, the server tells OpenCode which web address to open for the OAuth login. On Windows and WSL, OpenCode passed that address to a helper that wrapped it in a PowerShell command without escaping it, so a crafted address could carry a command that ran with the developer's own permissions.
Pillar Security found the bug, reported it privately on 29 August and rates it critical, proposing a score of 9.8 out of 10. Versions 1.0.137 to 1.18.32 are affected; Anomaly, the company behind OpenCode, fixed it in 1.18.33 on 28 September by updating the browser-opening package, describing the change as a refactor. macOS and Linux are not affected because there the address never goes through a shell.
The attack only fires when the developer actually starts the sign-in, for example with opencode mcp auth, and the attacker has to control a remote server the developer already added. That server could be one that was taken over later or a domain that changed hands. No CVE or advisory was issued, because Anomaly treats user-configured MCP servers as outside its trust boundary, so scanners and dependency alerts will not flag old installs. Pillar reported no sign of exploitation.
The same kind of bug hit the mcp-remote proxy in July 2025 (CVE-2025-6514), and the browser-opening package itself had fixed its Windows command-injection risk years earlier.
Why it matters: If anyone on your team runs OpenCode on Windows or WSL, check the version directly and upgrade to 1.18.33 or later, then run opencode mcp list and remove remote servers you have not vetted. Do not rely on scanners for this one.
Sources: The Hacker News
Highlights
Claude Code 2.1.309 closes a batch of sandbox and permission gaps
The 22 October release fixes sandboxed Bash commands on macOS and Linux running the shell's startup files outside the sandbox before each command, sandboxed commands and auto-accepted edits being able to change the file passed with --mcp-config, and a disabled MCP server being reconnected by a later permission prompt in print and SDK sessions. Several Bash permission checks and worktree-isolation guards were also tightened. Worth updating if you rely on the sandbox.
claude-codeagent-securitySource: Claude Code releases on GitHub
Claude Code 2.1.307 emits an OpenTelemetry event each time a safety layer steps in
The new claude_code.safety_event fires for every tool call that a permission rule, auto mode, a safety check, a hook or the sandbox stopped, prompted or sent back, so teams can count and audit blocks in their own telemetry. The 21 October release also adds /claude-api api-version to move Claude API code to API version 2026-10-21, and stops HTTP MCP tool calls from being sent twice when a connection drops mid-call.
claude-codeobservabilitySource: Claude Code releases on GitHub
OpenClaw 2026.10.6 refuses to run on unpatched Node.js
The open-source agent now requires Node 24.22.1 or later on the 24 line, or 26.12.1 or later on the 26 line, the releases that reject TLS chains signed with the compromised certificate keys addressed in October's Node.js security updates. Docker images ship the patched runtime, and openclaw update stops with recovery steps on an older Node instead of breaking a running install. The release also hardens updates, migrations and message delivery across restarts.
agentssupply-chainSource: OpenClaw releases on GitHub
inclusionAI releases Ling-3.0-flash-Sante, a healthcare model under the MIT licence
Built on Ling-3.0-flash, it has 124B total and 5.1B active parameters per token, a hybrid linear-attention mixture-of-experts design, training to 256K tokens, and thinking mode and tool calling on by default. It targets medical reasoning, healthcare research and tool-assisted workflows. The card says plainly it is a research model, not a medical device, and that high-stakes use needs qualified human review; all benchmark results on it are inclusionAI's own.
open-weightsmodelshealthSource: Hugging Face
Concept of the day
Why a server-supplied sign-in link can become a command
In OAuth, the service you sign in to tells your app where its login page lives, the authorization endpoint, and the app opens that address in a browser. If the app builds a shell command around the address to launch the browser and does not escape it, the address is no longer just data: characters in it can end the intended command and start a new one. Checking that the address begins with https does not help, because the attack can use an ordinary https address. The safe pattern is to launch the browser without a shell at all, which is why OpenCode's bug hit Windows and WSL but not macOS or Linux.
Source: The Hacker News
Models released
| Model | Maker | Size | Notes |
|---|---|---|---|
| Ling-3.0-flash-Sante | inclusionAI | 124B MoE, 5.1B active | Healthcare-specialised version of Ling-3.0-flash with Kimi Delta Attention, gated MLA and sparse MoE layers, training to 256K tokens, thinking mode on by default and tool calling via compatible serving frameworks. MIT licence. Research model, not a medical device; benchmark figures are the maker's own. |
Try this
graphify Turn your repo into a queryable graph instead of having your agent grep through files
Typing /graphify in a coding assistant maps the project into a knowledge graph you can query, trace paths through or ask to explain one concept. Code is parsed locally with tree-sitter, with no model and nothing leaving your machine; docs, PDFs, images and video use your assistant's model or an API key you configure. Each edge is marked as read directly from the source or inferred. Install with uv tool install graphifyy (or pipx), then graphify install. Needs Python 3.10+. A paid cloud version exists, but the local code mapping is free.
Source: Graphify-Labs/graphify on GitHub
Every item is checked against its primary source before it appears here. Figures we could not confirm are left out.
Related service: AI automation services for logistics
Five Agent Tricks, latest: Issue #3 (26 Oct 2026) · Subscribe free