{"slug": "ai-coding-agents-are-installing-mcp-servers-that-will-never-be-patched", "title": "AI coding agents are installing MCP servers that will never be patched", "summary": "Glow Labs documented AI coding agents installing deprecated, archived MCP servers that will never receive patches, a pattern the security firm calls MCPhantom, according to research published in Glow Security Review. In 98% of the reviewed real AI coding session transcripts where this occurred, the agent appears to have selected the unmaintained package when asked to set up a server such as a GitHub MCP. The finding matters because these abandoned packages land on developer machines with no path to future security fixes.", "body_md": "When a developer tells an AI coding agent to “set up a GitHub MCP,” the agent has to pick a package. New research from Glow Labs documents sessions where it picked one out of an archived repository that will never be patched again. Source: Glow Security Reviewing real AI coding session transcripts, Glow Labs found deprecated MCP servers landing on developer machines, a pattern it calls MCPhantom. In 98% of those sessions, the agent appears … [More](https://www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/) \n\nThe post [AI coding agents are installing MCP servers that will never be patched](https://www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/) appeared first on [Help Net Security](https://www.helpnetsecurity.com).", "url": "https://wpnews.pro/news/ai-coding-agents-are-installing-mcp-servers-that-will-never-be-patched", "canonical_source": "https://www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/", "published_at": "2026-11-03 05:45:53+00:00", "updated_at": "2026-11-03 05:50:43.617567+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-safety", "ai-tools", "developer-tools"], "entities": ["Glow Labs", "Glow Security Review", "MCPhantom", "GitHub", "Help Net Security"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/ai-coding-agents-are-installing-mcp-servers-that-will-never-be-patched", "markdown": "https://wpnews.pro/news/ai-coding-agents-are-installing-mcp-servers-that-will-never-be-patched.md", "text": "https://wpnews.pro/news/ai-coding-agents-are-installing-mcp-servers-that-will-never-be-patched.txt", "jsonld": "https://wpnews.pro/news/ai-coding-agents-are-installing-mcp-servers-that-will-never-be-patched.jsonld"}}