Glow Labs finds AI coding agents install unpatchable deprecated MCP servers

Glow Labs has documented a pattern it calls MCPhantom, in which AI coding agents place MCP servers from archived, deprecated code repositories onto developer machines, according to research published Nov. 3, 2026.

Anthropic created the MCP standard in 2024 and released 20 reference servers as examples for developers building integrations. When GitHub and other services later released their own servers, Anthropic saw little reason to keep maintaining duplicate examples, so Anthropic left the archived reference servers without anyone to fix them. MCP lets coding agents connect to services such as GitHub.

The research team saw the pattern in 98% of sessions in which an agent set up a deprecated MCP server. In 98% of those sessions, the agent appears to have chosen the package name from its model training data rather than from the user’s request. For the remaining 2%, the user named the deprecated package and the agent installed it.

GitHub maintains an official MCP server, yet Glow Labs found that in its GitHub example the agent skipped that server and selected a deprecated Anthropic reference server from its training data. When a developer asks to connect a service such as GitHub, the agent completes an early reference server name from its training data. The agent then writes the MCP configuration itself or provides the developer with a command, and npm installs the deprecated package.

No session in the review involved a malicious actor; the danger came from the agent’s own package selection based on training data. The pattern appeared in Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, and with models from Anthropic, OpenAI and xAI. Agents frequently summarize their actions instead of keeping precise logs, so a summary might say the agent installed an MCP server for database access while the actual log records the package, version and repository.

Researchers uncovered four high-severity vulnerabilities in the deprecated reference servers that Anthropic originally created when it launched MCP. A remote code execution flaw in the Puppeteer server is the most serious of those four vulnerabilities. With a prompt injection, an attacker can make the agent start any process on the machine rather than the browser and run any command the attacker chooses.

Glow Labs reported the bug, yet the repository had been archived in May 2025 and maintainers said it is unmaintained, meaning no fix or release will come from that repository. No patch is coming for the deprecated servers. The report was closed as out of scope, and no CVE identifiers have been assigned to the flaws.

The deprecated Anthropic repository carries an archived status, and its notice states that no one will provide security updates or bug fixes. Agents do not read archive notices, so the risk remains even when those notices are marked. In one session, the agent checked the package on npm and received the message “This package is deprecated,” then installed it without telling the user.

Glow Labs counted deprecated packages that have seen more than 17.3 million npm downloads since July 2025, with the figures supplied on Nov. 2, 2026. Five of the deprecated packages appear in npm’s top MCP 100. The server-github package had 185,239 downloads last week and lists six owners, so npm’s removal rules do not apply.

Under npm policy, an owner can remove a package only when it recorded fewer than 300 downloads in the past week, has one owner and no public dependents. npm removes packages containing malware, yet Glow Labs found no instance of removal for unpatched vulnerabilities. Maintainers said they might mark the npm package deprecated to warn users, but a deprecated package still installs through npx, a tool that runs Node packages.

These MCP servers function as dependencies that never show up in a dependency file, which means dependency scanning tools cannot detect them. Software inventory never registers the application, so the endpoint is the only place the server appears. Because the servers run locally, they had not shown up in earlier scans and only endpoint-focused inventory research found them.

EDR, or endpoint detection and response, sees a trusted Node process install a public npm package at the agent’s request, and that activity looks routine. SCA, or software composition analysis, has no manifest because the server runs through npx. None of the existing controls failed, since each examined exactly what it examines, and the software fell between them.

Glow Labs found the MCPhantom pattern by monitoring risky agentic behavior, tracking activities, identifying MCP installs and assessing how agents make decisions. Glow’s discovery and Glow Labs research have already flagged deprecated MCP servers carrying known vulnerabilities on endpoints.

Researcher Haseeb Mohammed Afsar independently counted about 195 new MCP servers added to the official registry each day. GitHub’s Octoverse 2025 report put the count of AI-related repositories at 4.3 million.

Glow Labs says it has not observed anyone exploiting these vulnerabilities. Glow Labs also said the chances of someone discovering these vulnerabilities have risen because of concerns raised by AI-powered bug hunting.

Security teams can search developer machines for MCP configurations that reference deprecated @modelcontextprotocol servers and replace them with the service owner’s own server where one exists. Teams can also make npm deprecation status part of the criteria for approving any MCP server. Another option is to approve one MCP server per service as the standard, which keeps agents from reverting to outdated training models.

Glow customers can locate every deprecated MCP server on developer machines with a single request through Glowy, Glow’s platform agent that covers more than 20 AI tools. Glowy can return endpoints, servers and versions when asked which endpoints have a deprecated @modelcontextprotocol server configured. Once an engineer approves, Glowy deletes the MCP server config entry on each endpoint. Glow flags every deprecated server on every endpoint at its next scan under an npm deprecation status policy, covering new installs too.

If an agent attempts to use a deprecated server, Glow blocks the call and redirects the agent to the approved server. Glow can also block calls to risky MCP servers through policy, preventing agents from using them even after installation. Glowy can contact affected developers by e-mail, Slack message, or by opening a Jira or ServiceNow ticket.

Nadav Claude Cohen, vulnerability researcher at Glow, said, “A lookup before install is not enough on its own.” Cohen said harness makers could reject deprecated servers or at least alert the operator, and cover servers already installed rather than only new installs. He said this harness fix works only if every harness adopts it, because a single fixed harness leaves the others open.

Cohen said model makers could update what models know, since old package names in model knowledge lead agents to keep installing them, but he called updating model weights expensive and unlikely. Cohen said package owners could fix the bugs, and that is the only fix that protects people who continue using these servers.

Cohen pointed to pre-execution hooks, which many harnesses already support, as a control security companies can use today without waiting for harness makers, model makers or package owners.

Ophir Arie said, “The model’s memory is now a package manager with no deprecation feed.” Dependency scanners and asset inventory miss these servers because the packages never appear in a manifest or dependency file, and no patch is coming for the deprecated servers.

The memory of an AI assistant can predate current security policy, and a model trained a year ago may reach for software that a team would reject now. Agents consider popularity metrics, download counts and documentation quality, and deprecated packages often have better documentation than the maintained replacements.

The browser connector flaw can be triggered by hidden instructions on a web page, and then the agent runs a command chosen by the attacker. Secure.com described this public flaw as hidden web instructions that cause command execution.

Glow Labs limited its review to sessions where a deprecated server was installed or suggested. Deprecation status for all twelve packages was confirmed against the npm registry on Nov. 3, 2026. A deprecated package disappears from npm search, yet npx still installs it with only a warning.