Glow: AI coding agents keep installing abandoned MCP tools picked from memory
98% of sessions where the agent, not the user, picked the deprecated tool
Security firm Glow says AI coding agents are installing abandoned MCP servers (add-on tools) on developer machines. Asked to connect a service such as GitHub, agents often picked an archived Anthropic reference server from their training data instead of the service’s own tool. In 98% of these sessions the agent, not the user, chose the package. In one session the agent saw a deprecation warning, installed the package anyway and did not tell the user. The pattern appeared across Claude Code, Cursor and Codex CLI and in models from Anthropic, OpenAI and xAI. Glow found four high-severity flaws in the archived servers that will not be patched, but has seen no exploitation.
The model's memory is now a package manager with no deprecation feed.
Alan's takeAgents pick packages all the time, but we don’t expect them to read a deprecation warning and install the package anyway. One more thing to worry about when the coding agent recommends a tool.