Problem Solutions
MCPhantom: Your Coding Agent Keeps Installing Abandoned MCP Servers With Known Vulnerabilities
When you ask a coding agent to connect an MCP server, it has to choose a package. Glow Labs reviewed transcripts of real AI coding sessions and found that in 98% of the sessions where an agent installed or suggested a deprecated server, the name came from the model's training data, not from anything it looked up. The pattern, published on November 2 and named MCPhantom, is a memory problem, not a judgment problem: the agent fills in the name it remembers, and the name it remembers is retired.
The servers in question are Anthropic's early reference servers, published when MCP launched in 2024 and archived in May 2025. The archive notice says no security updates or bug fixes will be provided. Four high-severity vulnerabilities have been found in them, including a remote code execution flaw, and no patch is coming from that repository. The agents keep installing them anyway.
What the agents install
In Glow Labs' GitHub example, the agent was asked to connect GitHub's MCP server. GitHub maintains its own. The agent passed over it and installed @modelcontextprotocol/server-github, a deprecated Anthropic reference server whose repository is archived. The pattern showed up in every harness in the data: Claude Code, Cursor, Codex CLI, Claude Cowork and Claude Chat, on models from Anthropic, OpenAI and xAI. No single vendor ships a fix for this, because the failure is not in one harness. It is in how models recall package names.
The 2% tells the same story from the other side. In the remaining sessions, the user asked for the outdated package by name, and the agent obliged. In the other 98%, nobody asked. The agent supplied the name from memory, and the memory was a year out of date.
Four flaws, no patches
Glow Labs found four high-severity vulnerabilities across the archived reference servers. The most serious is a remote code execution bug in the Puppeteer server, the tool that lets an agent drive a web browser. With a prompt injection, an attacker can make the agent start any process on the machine instead of a browser. The servers were archived in May 2025, so no fixes will be released for these issues, and Glow Labs' report of the flaw was closed as out of scope by the maintainers, on the grounds that the repository is unmaintained.
No exploitation has been seen yet, and no patch is coming either. That combination is the worst kind of exposure: the vulnerability is public, the fix does not exist, and the installation keeps happening automatically, invisible to the security tools that would normally catch a bad package. Agent-based npx executions are invisible to endpoint detection, software composition analysis and software inventory, so the deprecated servers do not show up where teams look for them.
The scale
Usage has not followed the deprecations. The deprecated packages Glow Labs counted have been downloaded from npm more than 17.3 million times since July 10, 2025, and five of them rank among npm's top 100 MCP packages. Server-github alone accounts for 5.27 million downloads, server-postgres 4.31 million, and server-slack 3.20 million. Anthropic published 20 reference servers in 2024 and later archived 13 of them, and the archived set keeps circulating because the models keep naming it.
Read the 98% carefully
The 98% figure needs its caveat stated plainly. Glow Labs has not disclosed its session sampling methodology: the sample size, its structure, and the distribution of agents and prompts are unknown. Until the methodology is published, the number should be read as a Glow Labs vendor report, not a reproducible study. The study also only looked at sessions where a deprecated server was installed or suggested. It says nothing about how often agents choose correctly overall.
None of that weakens the core finding. The archived packages exist, the vulnerabilities are real, the maintainers will not fix them, and the agents demonstrably pick them from memory. The percentage is uncertain; the mechanism is not.
What to do
The fix is structural, not a matter of asking the agent more politely. Set up a pinned registry: the agent resolves tools through a registry you control, with version pins, and a name that is not on the approved list cannot be installed, no matter how confidently the model recalls it. Approve one MCP server per service, so agents cannot revert to an older training artifact. Glow Labs lands in the same place from the operations side.
Then audit what is already installed. Check your agent configs and transcripts for @modelcontextprotocol/server-* packages, and replace any archived reference server with the official maintained server for that service. Remove the archived servers rather than leaving them in place, and check npx invocations in agent transcripts, since that is where the invisible installs happen. The deprecated server on your machine is not a theoretical risk. It is a package with a known remote code execution flaw, no patch, and a model that will keep reinstalling it unless you take the choice away.