This occurs when a developer instructs an AI coding agent to "set up a GitHub MCP," compelling the agent to select a specific package. The new study from Glow Labs documents instances where the agent selected a package originating from a repository that has since been archived and will receive no further security updates.
In a significant majority of the observed sessions, specifically 98%, the agent exhibits this behavior, according to the research.
This finding highlights an immediate operational risk concerning the integration of automated coding assistants into development environments, pointing toward potential supply chain vulnerabilities related to dependency management.
Why it matters
This highlights a significant security risk in automated development workflows, as unpatched, legacy components are being deployed directly onto developer infrastructure. Operators must monitor how AI tools interact with package repositories to prevent the introduction of persistent vulnerabilities.
