AI coding agents install unpatched archived MCP servers

# AI coding agents install unpatched archived MCP servers

https://gcdradar.vercel.app/incidents/ai-coding-agents-install-unpatched-archived-mcp-servers · AIR-2026-1725 · live

- Lane: Research
- Severity: 1 (Research / proof of concept): Research demonstration showing unpatched deprecated packages being introduced by agents.
- Fix status: Fix status unknown
- First reported: 2026-11-03
- AI role: Attack on AI
- Products: MCP servers

## Summary

Research shows AI coding agents select deprecated and unpatched Model Context Protocol servers from archived repositories during user sessions. This creates ongoing supply chain exposure on developer machines.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-03: AI coding agents are installing MCP servers that will never be patched (https://helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers)

## Sources

- 2026-11-03 Help Net Security: AI coding agents are installing MCP servers that will never be patched https://helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.