Glow Labs warns AI coding agents install unpatched MCP servers

Research from Glow Labs reveals that AI coding agents frequently install deprecated and unmaintained MCP servers from their training data rather than current repositories, exposing developer machines to high-severity vulnerabilities like remote code execution. Investigators found that 98% of these sessions involved the agent choosing an archived package automatically, while existing security tools such as EDR and SCA often fail to detect them because they run via npx without standard manifest files. Open article →