According to a recent LinkedIn post from Glow, research from Glow Labs examined how AI coding agents select and install software during real coding sessions. The study reportedly covered five tools, including Claude Code, Cursor, and Codex CLI, and was led by Nadav Claude Cohen, head of Glow Labs.
The post highlights a finding that 98% of deprecated package installations involved names drawn from model training data rather than developer choices. It also suggests that those packages referenced archived servers, with the pattern appearing across the tools and model providers examined.
Glow’s post further points to 17.4 million npm downloads for the deprecated servers since July 2025, including one package with a remote code execution vulnerability whose maintainers reportedly do not plan to issue a fix. The findings underscore potential security and operational risks as companies adopt AI-assisted software development.
For investors, the research may support demand for tools that monitor AI-generated dependencies, validate software sources, and prevent unsafe installations. At the same time, recurring vulnerabilities could increase compliance, remediation, and reputational costs for organizations deploying coding agents, although the post does not provide financial projections or disclose a direct commercial impact for Glow.