---
title: "Unauthenticated Remote Code Execution in OpenCode"
description: "OpenCode silently exposed shell, terminal, and file access through an unauthenticated local server. A coding agent’s most useful capability was also its exploit."
author: "Pau Friedman"
kind: "link"
published_at: "2026-01-12"
url: "https://pau.fm/blog/2026/01/12/unauthenticated-remote-code-execution-in-opencode"
markdown_url: "https://pau.fm/blog/2026/01/12/unauthenticated-remote-code-execution-in-opencode.md"
canonical_url: "https://pau.fm/blog/2026/01/12/unauthenticated-remote-code-execution-in-opencode"
external_url: "https://cy.md/opencode-rce/"
---

# [Unauthenticated Remote Code Execution in OpenCode](<https://cy.md/opencode-rce/>)

> Before v1.1.10, OpenCode automatically and silently started an unauthenticated web server which
> allowed connecting peers to execute arbitrary code.

OpenCode’s core feature is arbitrary code execution. The bug was making that feature available to
every process on the machine—and, in earlier versions, every website—without asking. `localhost` is
a routing decision, not a security boundary, and CORS is not authentication.

Coding agents need broad authority to be useful, which makes their boring boundaries more important
than their clever models. The shell is the product. Authorization has to be part of it.