AI coding agents are installing MCP servers that will never be patched

AI coding agents asked to set up MCP servers have picked packages from archived repositories that will never be patched again, according to research from Glow Labs based on real AI coding session transcripts. Glow calls the pattern MCPhantom and found deprecated MCP servers landing on developer machines, in most documented sessions without the risk being surfaced.