AI coding agents are installing abandoned MCP servers with known security issues
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Glow Labs reports that AI coding agents repeatedly install deprecated Anthropic MCP reference servers, such as GitHub and Puppeteer, because those names appear in their training data rather than current registries. The archived servers carry four high-severity vulnerabilities, including remote code execution in Puppeteer, and maintainers have declined fixes.