# AI coding agents are installing MCP servers that will never be patched

> Source: <https://www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/>
> Published: 2026-11-03 05:45:53+00:00

When a developer tells an AI coding agent to “set up a GitHub MCP,” the agent has to pick a package. New research from Glow Labs documents sessions where it picked one out of an archived repository that will never be patched again. Source: Glow Security Reviewing real AI coding session transcripts, Glow Labs found deprecated MCP servers landing on developer machines, a pattern it calls MCPhantom. In 98% of those sessions, the agent appears … [More](https://www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/) 

The post [AI coding agents are installing MCP servers that will never be patched](https://www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/) appeared first on [Help Net Security](https://www.helpnetsecurity.com).