Signing in to an MCP server was enough to get your machine taken over. Pillar Security found a flaw in OpenCode on Windows and WSL. When you signed in to a remote MCP server, the server told OpenCode where to send your browser. OpenCode passed that link to PowerShell without escaping it. So a server could hide a command inside an ordinary-looking https link, and it ran with your permissions. The server didn't need to start out malicious. One that's taken over later, or a domain that changes hands, works just as well. If you use OpenCode on Windows or WSL, update to 1.18.33 or later. No CVE was issued, so scanners won't flag older builds. The bigger lesson: an MCP server isn't just a list of actions. It takes part in sign-in, it decides where your browser goes, and it sees what you send it. Connecting one is a trust decision. That's how we built Gephyr: •A company has to prove it owns its domain and its login before its connector goes live. •Every sign-in link our connectors hand out is built on gephyr.ai, never from text a customer typed. •Payments, cancellations and other risky actions can ask the user first, every time. •The AI app never gets your login. People sign in on the app's own page. The AI app gets a pass that only works for that one connector, and Gephyr keeps the real key to the app's API encrypted. •Gephyr never runs anyone's code. A connector is settings only: which endpoints, which inputs. So a connector can't carry the kind of attack that hit OpenCode. •It only talks to the app's own API. Calls go to the company's own addresses only, over https, and redirects aren't followed. A connector can't be turned against other sites. •Gephyr guards against hidden instructions. Text written by other people, like messages or reviews, is marked so agents treat it as content, not orders. Hidden characters and known attack phrases are stripped or blocked before a connector goes live. Read more about how we deal with MCP security: gephyr.ai/security/