Coding Agents
2 articles
-
MCPCoding Agents Still Install an MCP Server Archived in 2025
Glow Security's MCPhantom research (2 Nov 2026) says coding agents name archived MCP reference servers from model memory, not from a lookup; in 98% of the deprecated installs it reviewed the user had not asked for that package by name. Verified hands-on: ten headless Claude Code runs (Haiku 5.5 and Sonnet 5.5) plus a Codex run, each asked to write the MCP config for a GitHub, Postgres, Slack, browser and Brave server. Both models named the archived @modelcontextprotocol/server-postgres for Postgres; Sonnet also returned archived server-github, server-slack and server-brave-search; Haiku returned GitHub's hosted remote and Brave's own @brave/brave-search-mcp-server; Sonnet returned @playwright/mcp for the browser; Codex pointed at github/github-mcp-server. All the reference servers are deprecated on npm and live in modelcontextprotocol/servers-archived (archived, last push 2025-05-28, README states NO SECURITY GUARANTEES). This morning the npm deprecation text on the GitHub, Postgres and Puppeteer packages was rewritten from the generic contact-npm-support boilerplate to Archived and unmaintained; no security guarantees when issue #4785 was closed at 04:21 UTC; npx prints it and installs anyway.
-
OpencodeOpenCode's Exposed Keys Ignore the Budgets You Set
On 17 October OpenCode told 1.4% of its hosted Console users that the Anthropic, OpenAI and Google keys saved in their workspaces may have been exposed through unauthorized access to a legacy system being decommissioned, and called it a large scale distillation attack; the keys were there by design, because Console stores the credential and serves it through its gateway so members never see it, and the monthly budget Console offers is enforced by that gateway, so a lifted key used directly against the provider answers only to the provider's own limit: Anthropic caps spend per workspace but not on the Default Workspace, OpenAI's hard limit is per organization or project and not instantaneous, and Google offers billing alerts and no cap. Revoke at the provider, not in Console, and give every third-party gateway a capped workspace or project of its own.