Pillar Security says opencode, the open-source coding agent, passed the authorization_endpoint URL that a remote MCP server returns during OAuth discovery straight to the open npm package. On Windows and WSL that goes through PowerShell, so an ordinary-looking https:// URL with $(...) inside ran attacker commands on the developer's machine. No prompt injection, no install and no extra click were needed; just connecting to the server was enough. Checking the URL scheme doesn't stop it. The server doesn't have to be malicious when you add it: a later compromise, a hijacked registry entry, a typosquat or an expired domain could deliver the same payload. Pillar says the same bug class, in the same package and OAuth field, was CVE-2025-6514 (9.6) in July 2025. Affected versions are 1.0.137 through 1.18.32 on Windows and WSL; macOS and Linux are not affected. The fix shipped in 1.18.33 on Sep 28, 2026. Pillar says opencode's developer, Anomaly, shipped it as a refactor without an advisory or CVE, saying malicious remote MCP servers are outside its threat model, so scanners and dependency bots won't flag old installs. Pillar's proposed CVSS is 9.8. What to do: run opencode --version on Windows and WSL machines and upgrade anything below 1.18.33. Inventory installs directly rather than relying on CVE scanners, and treat every field a remote MCP server sends as untrusted input.