Skip to content
AI Security Wire

Published

- 5 min read

By

MCPhantom: AI Coding Agents Installed Deprecated, Unpatched MCP Servers

MCP AI coding agents supply chain deprecated packages prompt injection Glow Labs
img of MCPhantom: AI Coding Agents Installed Deprecated, Unpatched MCP Servers

When a developer tells an AI coding agent to “set up a GitHub MCP,” the agent has to pick a package. New research from Glow Labs, published on 2-3 November 2026, says that choice is sometimes an archived server that nobody will patch again.

What Glow Labs found

Glow Labs reviewed real AI coding session transcripts and found deprecated MCP servers landing on developer machines. It calls the pattern MCPhantom. The research looked only at sessions where a deprecated server was installed or suggested, so the figures below are a cause split among those sessions, not an install rate. Glow gives no sample size. In 98% of them, the report says the agent appears to have filled in the package name from its training data. In the other 2%, the user asked for the old package by name.

The example Glow Labs documents is GitHub. GitHub maintains its own MCP server, but the agent chose an older Anthropic reference server instead. That repository is archived and its notice says no security updates are coming. Glow’s wording is that agents “are not going to pay much attention to the archived notices.”

The pattern appeared across Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, and with models from Anthropic, OpenAI and xAI. So no single vendor can close the gap alone. This is Glow Labs’ reading of its own data, and the sample size is not stated in the coverage we reviewed.

The vulnerabilities

Glow Labs says it found four vulnerabilities, which it rates high-severity (no scoring source is given), in the deprecated reference servers. The most serious is a remote code execution bug in the Puppeteer server. Per the researchers, a prompt injection is enough: the agent starts an arbitrary process on the machine instead of driving a browser. The developer approved web browsing, and that one permission stretches to cover the rest, so the agent harness lets it through.

Glow Labs reported the bug. The maintainers replied that the server was archived in May 2025 and is unmaintained, so no fix or release will come from the repository. Glow’s account is that the report was closed as out of scope and that the maintainers said they would look at marking the npm package deprecated. The npm registry already shows the package as deprecated, and we could not date when that happened.

Two things the sources do not give us: the other three flaws are not described, and none has a CVE identifier. Glow’s disclosure timeline says it reported a flaw via HackerOne and a GitHub advisory on 30 July (HackerOne closed it as out of scope), reported all four to Anthropic’s CNA on 4-11 October, and that the maintainers closed the advisory in October. A CVE request may therefore still be pending. No evidence found as of 4 November 2026 in NVD keyword searches for the Puppeteer server, the GitHub advisories API, or the Glow and Help Net Security write-ups of any CVE for these flaws. We could not independently check the technical details of any of the four. Glow Labs says it has not seen anyone exploit them.

Why scanners stay quiet

These servers run through npx, so they sit in no project manifest. Glow Labs lays out why the usual controls miss them:

  • Software composition analysis has no manifest to read, and no CVE exists to match.
  • EDR sees a trusted Node process installing a public npm package, which looks routine.
  • Software inventory never registers an application, because the server runs inside a Node process.
  • Agent harness guardrails do not know the package is deprecated.

The endpoint is the one place it shows up. Pulling the packages is not simple either. Help Net Security, which relays Glow’s research and an interview with its researcher, reports that npm lets an owner remove a package only under narrow conditions (fewer than 300 downloads in the past week, a single owner, no public dependents), and the researcher quoted found no removal for vulnerabilities alone. A deprecated package also still installs through npx with only a warning.

Scale

Glow Labs counts more than 17.3 million npm downloads of Anthropic’s deprecated reference servers since July 2025, with five of them in npm’s top MCP 100 (the ranking is Glow’s and we did not check it). We checked the npm registry on 4 November: @modelcontextprotocol/server-puppeteer is marked as deprecated, with 2025.5.12 as its latest version. The npm downloads API reported 189,189 downloads of @modelcontextprotocol/server-github for 28 October to 3 November. Those figures show the packages are still being pulled. They do not show how many of those installs came from an agent’s own choice.

What to do

Glow Labs offers three steps, and they are cheap to try:

  1. Search developer machines for MCP configs that reference the deprecated @modelcontextprotocol servers, and switch to the service owner’s own server where one exists.
  2. Approve one MCP server per service, so agents have a single sanctioned answer.
  3. Check npm deprecation status before approving any server.

Our assessment: an allow-list enforced where the config is written is more reliable than asking the agent to check first. Glow’s researcher makes a similar point to Help Net Security (“A lookup before install is not enough on its own”) and says pre-execution hooks in many harnesses work today. Glow Labs’ own researcher says an agent saw npm’s “This package is deprecated” message in one session, installed the package anyway, and never told the user.

One caveat on sourcing. Glow Labs sells endpoint inventory tooling, and its post ends with a pitch for it. The research is a single-vendor finding. Help Net Security’s coverage relays it rather than confirming it. We ran one web search on 4 November 2026 for independent coverage and found none, and that search index is weak.

References

Frequently Asked Questions

What is MCPhantom?
MCPhantom is the name Glow Labs gave to a pattern it observed in real AI coding sessions: agents installing deprecated Model Context Protocol servers that were retired when the original service owners shipped their own. In 98% of the sessions where an agent set up a deprecated server, Glow Labs says the agent appears to have chosen the name from its training data.
Is there a patch or a CVE for the Puppeteer MCP server bug?
No, according to Glow Labs and Help Net Security. The maintainers closed the report as out of scope because the server was archived in May 2025, and they said no fix or release will come from that repository. The four high-severity flaws also have no CVEs, which Glow Labs says is why dependency scanners do not flag them.
Has anyone exploited these servers?
Glow Labs says it has not seen exploitation of these vulnerabilities. That is a statement from the researchers about their own data, not a statement about the wider internet. Exploitation would need a prompt injection that reaches an agent running the deprecated Puppeteer server.
What should security teams do?
Glow Labs recommends finding MCP configs that reference the deprecated @modelcontextprotocol servers and replacing them with the service owner's own server where one exists. It also recommends approving one MCP server per service and adding npm deprecation status to approval criteria.