AI coding agents are installing MCP servers that will never be patched

When a developer tells an AI coding agent to “set up a GitHub MCP,” the agent has to pick a package. New research from Glow Labs documents sessions where it picked one out of an archived repository that will never be patched again.

Source: Glow Security

Reviewing real AI coding session transcripts, Glow Labs found deprecated MCP servers landing on developer machines, a pattern it calls MCPhantom. In 98% of those sessions, the agent appears to have filled in the name from the model’s training data. In the other 2%, the user asked for the old package by name. The research looked only at sessions where a deprecated server was installed or suggested.

GitHub maintains an MCP server of its own. In the GitHub example Glow Labs documents, the agent passed over it for a deprecated Anthropic reference server from its training data. The repository is archived and says no security updates are coming, but agents don’t read archive notices.

The same pattern showed up across Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, and models from Anthropic, OpenAI and xAI.

Four flaws, no patches

Four high-severity vulnerabilities turned up in those reference servers. The most serious is a remote code execution bug in the Puppeteer server, which lets an agent drive a browser. A prompt injection is all it takes. The agent starts any process on the machine instead of the browser, and runs any command the attacker chooses. The developer approved web browsing, and that one permission stretches to cover the rest, so the harness lets it through.

Glow Labs’ report was closed as out of scope, and the maintainers replied that the server was archived in May 2025 and is unmaintained, so no fix will come from that repository. They did say they would look at marking the npm package deprecated so users get a warning, but a deprecated package still installs through npx. No exploitation has been seen yet, and no patch is coming either.

Usage hasn’t followed the deprecations. The deprecated packages Glow Labs counted have been downloaded from npm more than 17.3 million times since July 2025, with five of them in npm’s top MCP 100.

Why existing controls stay quiet

These servers are dependencies that never appear in a dependency file. EDR watches a trusted Node process install a public npm package at the agent’s request, which looks routine. SCA has no manifest, since the server runs through npx, and the flaws have no CVEs. Software inventory never registers an application, so the endpoint is the only place it shows up.

Asking the agent to look things up first isn’t the answer either. “A lookup before install is not enough on its own,” Nadav Claude Cohen , vulnerability researcher at Glow, told Help Net Security. “In one session the agent checked the package on npm and got back ‘This package is deprecated.’ It installed the package anyway and never told the user.”

Cohen sees four possible sources of a fix:

Harness makers could refuse deprecated servers, or at least warn the operator, and cover the ones already installed rather than only new installs, but “it works only if every harness does it. If one harness fixes it, the others stay open.”

Model makers could update what the models know: “as long as the models’ knowledge contains the old package names, agents will keep installing them,” though “updating model weights is very expensive, so this is unlikely to happen.”

The package owners could fix the bugs, “the only fix that protects people who keep using these servers.”

Security companies can use the pre-execution hooks many harnesses already support: “This works today, without waiting for the harness makers, the model makers or the package owners.”

Pulling the packages isn’t an option. npm lets an owner remove one only if it had fewer than 300 downloads in the past week, has a single owner and no public dependents. “server-github had 185,239 downloads last week and has 6 owners,” Cohen says. npm removes packages that contain malware, but he found no case of removal for vulnerabilities.

Security teams can start by finding MCP configs that reference the deprecated @modelcontextprotocol servers and switching to the service owner’s server where one exists, approving one server per service, and adding npm deprecation status to the approval criteria.

“The model’s memory is now a package manager with no deprecation feed,” said Ophir Arie , Glow VP of R&D, who argues teams have to treat the agent’s decision-making as suspect and in need of controls.

Download: The IT leader’s guide to AI code sprawl