AI coding agents are installing MCP servers that will never be patched

Glow Labs documented AI coding agents installing deprecated, archived MCP servers that will never receive patches, a pattern the security firm calls MCPhantom, according to research published in Glow Security Review. In 98% of the reviewed real AI coding session transcripts where this occurred, the agent appears to have selected the unmaintained package when asked to set up a server such as a GitHub MCP. The finding matters because these abandoned packages land on developer machines with no path to future security fixes.

When a developer tells an AI coding agent to “set up a GitHub MCP,” the agent has to pick a package. New research from Glow Labs documents sessions where it picked one out of an archived repository that will never be patched again. Source: Glow Security Reviewing real AI coding session transcripts, Glow Labs found deprecated MCP servers landing on developer machines, a pattern it calls MCPhantom. In 98% of those sessions, the agent appears … More https://www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/ The post AI coding agents are installing MCP servers that will never be patched https://www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/ appeared first on Help Net Security https://www.helpnetsecurity.com .