# AI coding agents are installing MCP servers that will never be patched

DevFeed: [AI coding agents are installing MCP servers that will never be patched](<https://devfeed.tech/articles/ai-coding-agents-are-installing-mcp-servers-that-will-never-be-patched-113181.md>)

Original publisher: [Read original article](<https://www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/>)

Author: Mirko Zorz

Published: 2026-11-03T05:45:53Z

Content type: news

Language: en

Sources: [Help Net Security](<https://devfeed.tech/sources/help-net-security.md>)

Topics: [agentic-coding](<https://devfeed.tech/topics/agentic-coding.md>), [Agent Harness](<https://devfeed.tech/topics/agent-harness.md>), [AI-assisted coding](<https://devfeed.tech/topics/ai-assisted-coding.md>), [software dark matter](<https://devfeed.tech/topics/software-dark-matter.md>), [ecosystem-security](<https://devfeed.tech/topics/ecosystem-security.md>), [trust](<https://devfeed.tech/topics/trust.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-coding](<https://devfeed.tech/tags/ai-coding.md>), [ai-coding-agent](<https://devfeed.tech/tags/ai-coding-agent.md>), [ai-coding-agents](<https://devfeed.tech/tags/ai-coding-agents.md>), [anthropic](<https://devfeed.tech/tags/anthropic.md>), [claude-code](<https://devfeed.tech/tags/claude-code.md>), [coding](<https://devfeed.tech/tags/coding.md>), [coding-agent](<https://devfeed.tech/tags/coding-agent.md>), [coding-agents](<https://devfeed.tech/tags/coding-agents.md>), [cursor](<https://devfeed.tech/tags/cursor.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [deprecated](<https://devfeed.tech/tags/deprecated.md>), [developer](<https://devfeed.tech/tags/developer.md>), [github](<https://devfeed.tech/tags/github.md>), [glow](<https://devfeed.tech/tags/glow.md>), [labs](<https://devfeed.tech/tags/labs.md>), [machines](<https://devfeed.tech/tags/machines.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-servers](<https://devfeed.tech/tags/mcp-servers.md>), [news](<https://devfeed.tech/tags/news.md>), [openai](<https://devfeed.tech/tags/openai.md>), [package](<https://devfeed.tech/tags/package.md>), [patched](<https://devfeed.tech/tags/patched.md>), [research](<https://devfeed.tech/tags/research.md>), [servers](<https://devfeed.tech/tags/servers.md>), [software-development](<https://devfeed.tech/tags/software-development.md>)

## AI overview

Glow Labs reports that coding agents installed or suggested deprecated MCP servers in the sessions it examined; in 98% of those cases, agents appeared to select package names from training data. The pattern spanned several coding tools and models. Four high-severity vulnerabilities were found in the reference servers, including a Puppeteer server flaw that can turn browser access into arbitrary command execution through prompt injection. The archived repository will not be patched, and npm deprecation warnings would not prevent npx installation. The excerpt says common controls can miss these servers because npx installs leave no dependency manifest or registered application, and one agent installed a package despite finding its deprecated status. Suggested steps include replacing deprecated servers with service-owner versions where available, approving one server per service, and including npm deprecation status in approval criteria. Harness warnings or refusal and security checks through pre-execution hooks are also proposed; coverage may vary across harnesses.

## Source excerpt

When a developer tells an AI coding agent to "set up a GitHub MCP," the agent has to pick a package. New research from Glow Labs documents sessions where it picked one out of an archived repository that will never be patched again. Source: Glow Security Reviewing real AI coding session transcripts, Glow Labs found deprecated MCP servers landing on developer machines, a pattern it calls MCPhantom. In 98% of those sessions, the agent appears ... More -> The post AI coding agents are installing MCP servers that will never be patched appeared first on Help Net Security.