cd /news/ai-agents/ai-coding-agents-are-installing-mcp-… · home › topics › ai-agents › article
[ARTICLE · art-162935] src=helpnetsecurity.com ↗ pub= topic=ai-agents verified=true sentiment=↓ negative

AI coding agents are installing MCP servers that will never be patched

Glow Labs documented AI coding agents installing deprecated, archived MCP servers that will never receive patches, a pattern the security firm calls MCPhantom, according to research published in Glow Security Review. In 98% of the reviewed real AI coding session transcripts where this occurred, the agent appears to have selected the unmaintained package when asked to set up a server such as a GitHub MCP. The finding matters because these abandoned packages land on developer machines with no path to future security fixes.

by read1 min views3 publishedNov 3, 2026

When a developer tells an AI coding agent to “set up a GitHub MCP,” the agent has to pick a package. New research from Glow Labs documents sessions where it picked one out of an archived repository that will never be patched again. Source: Glow Security Reviewing real AI coding session transcripts, Glow Labs found deprecated MCP servers landing on developer machines, a pattern it calls MCPhantom. In 98% of those sessions, the agent appears … More

The post AI coding agents are installing MCP servers that will never be patched appeared first on Help Net Security.

source & further reading
helpnetsecurity.com — original article AI-powered infostealer picks out the most profitable parts of your stolen data Chainalysis breached using “offensive agentic techniques” DeepSeek open-sources Super-Agent, a coding agent that watches team chats for work
── more in #ai-agents 4 stories · sorted by recency
── more on @glow labs 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
→ Live at https://your-agent.zahid.host ✓
Get free account → Pricing
from €0/mo · no card required
LIVE [news/ai-coding-agents-are…] indexed:0 read:1min 2026-11-03 · —