Deprecated MCP Servers Installed by AI Agents Carry Unfixed Flaws

The agent picks the package, and it picks badly

A developer types "set up a GitHub MCP" into a coding assistant. The assistant has to choose which Model Context Protocol server to install, and new research shows it often chooses one that its maintainers abandoned more than a year ago. Glow Labs, the research arm of Glow Security, reviewed transcripts of real AI coding sessions and found deprecated MCP servers ending up on developer machines. It calls the pattern "MCPhantom."3

The study looked only at sessions where an agent installed or suggested a deprecated server. Within that set, the agent appears to have supplied the package name from the model's training data in 98% of cases. In the remaining 2%, the user had asked for the outdated package by name.11 In Glow's GitHub example, GitHub maintains its own MCP server, but the agent skipped it and installed an Anthropic reference server whose repository is archived and states that it will get no security updates.11

The behavior was not limited to one product. Help Net Security reports that the pattern appeared in Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, using models from Anthropic, OpenAI and xAI.11 A detection proposal filed in a community rules repository the day after the disclosure names a slightly shorter list of tools, but it describes the same mechanism: the agent either writes the MCP configuration itself or gives the user an npx command, and npm installs the package with nothing more than a deprecation warning.14

Four flaws that will never be fixed

The research matters because of what these servers contain. Glow Labs reported four high-severity vulnerabilities in the archived reference servers. The worst is a remote code execution bug in the Puppeteer server, the tool that lets an agent drive a web browser.3 A prompt injection can make the agent launch any process on the machine in place of the browser and then run commands chosen by the attacker. The developer only approved browsing, but the harness treats that single permission as covering everything that follows.3

When Glow reported the bug, it was closed as out of scope. The maintainers said the server had been archived in May 2025 and was no longer maintained, so that repository will not ship a fix.11 They said they would consider marking the npm package as deprecated so users see a warning. Even so, a deprecated package still installs through npx.11 There is no known exploitation so far, but there is also no patch coming.3

Usage has not dropped. Glow counted more than 17.3 million npm downloads of the deprecated packages since July 2025, and five of them rank among npm's top 100 MCP packages.3 The community detection proposal gives a figure of about 17.35 million and dates the count from 10 July 2025, which matches the headline number.14 The same proposal lists the archived reference servers it watches for, including the GitHub, GitLab, Slack, Postgres, Redis, Puppeteer, Brave Search and Google Maps servers, plus the Python-distributed SQLite and Sentry servers. It also notes that the filesystem server is still maintained and should not raise an alert.14

Why security tooling misses it

At first this looks like an ordinary outdated-dependency problem. It isn't, because none of the usual controls see it. These servers are dependencies that never appear in a dependency file.11 To endpoint detection, a trusted Node process installing a public npm package looks routine. Software composition analysis needs a manifest, and npx execution produces none. The flaws also have no CVEs, and software inventory never records an installed application, so the only trace is on the endpoint itself.11

Other researchers have raised the same blind spot. A September analysis of MCP supply-chain risk cited Stacklok's finding that npx execution bypasses local security tooling: a package runs straight from the registry with no SBOM, no audit, no lock file and no scan.13 The same analysis noted that npx does not respect package-lock.json by default, and most MCP registries cannot pin packages by content.13

Telling the agent to check before it installs does not solve the problem either. Glow vulnerability researcher Nadav Claude Cohen described a session in which the agent looked up the package on npm, was told it was deprecated, installed it anyway, and never told the user.11 Ophir Arie, Glow's VP of R&D, put it this way: the model's memory now acts as a package manager without a deprecation feed.11

A pattern of "won't fix" across MCP

MCPhantom is new, but the maintainers' response is not. Across 2026, many MCP security disclosures have ended with the responsible party declining to fix the underlying problem.

The largest example is OX Security's April disclosure about the STDIO transport in Anthropic's official MCP SDKs. According to the Cloud Security Alliance, the transport passes configuration parameters to the host shell without sanitization, and Anthropic said the behavior was intentional and declined to change the protocol architecture. That left downstream developers responsible for fixing it.5 The CSA estimated about 200,000 vulnerable instances in a supply chain covering more than 150 million package downloads.5 Other reports agree that the issue remains unfixed at the protocol level.1

Other vendors have responded in similar ways. Sentry declined a root-cause fix for the "agentjacking" technique that abused its MCP integration and deployed a payload-string filter instead.10 Akamai reported a flaw in Alibaba's RDS MCP server, Alibaba called it "not applicable," and Akamai escalated the case to CERT/CC.4 In Cursor, a planted-binary attack was ruled out of scope and has no known fix, and an MCP install-dialog bypass called DeepJack was closed as a duplicate with no CVE.16

Not everything goes unfixed. When Anthropic's actively maintained Git MCP server was hit by a three-CVE exploit chain in January, the bugs were patched.10 The CSA's tracking table shows that most high-severity MCP CVEs from 2025 and 2026 have fixes, including those in MCP Inspector, Cursor and LiteLLM.5 The difference between those cases and MCPhantom is maintenance status. Live projects get patched, while archived ones are frozen with their bugs. Coding agents make this worse because they keep installing frozen packages long after people have moved on.

The broader exposure

MCPhantom adds to an already large set of problems. UltraViolet Cyber counted more than 40 CVEs disclosed against MCP implementations in 2026 alone.6 The VIPER-MCP academic project scanned 39,884 MCP server repositories and confirmed 106 zero-day vulnerabilities, 67 of which have CVE IDs so far.4 Scans by Wiz, Bloomberry and Censys found that about 38% to 40% of reachable MCP servers have no authentication.1 In September, CISA added an MCP-related LiteLLM vulnerability to its Known Exploited Vulnerabilities list for the first time.7

Most of those findings involve servers someone chose to deploy. MCPhantom is different because the operator never really made the choice. The agent filled in the package name from memory. That makes the risk harder to govern than a bad server picked by a careless developer. Changing developer habits does not help when the developer never typed the package name.

Who can actually fix this

Cohen sees four groups that could fix the problem, and each has limits.11 Harness makers could block deprecated servers or warn users, including about servers already installed. He notes that this only works if every harness does it, because one holdout leaves the gap open.11 Model makers could update what their models know, but Cohen thinks retraining is too expensive to be likely.11 Package owners could fix the bugs, which he calls the only fix that protects people who keep using these servers. Given the maintainers' response, that seems unlikely.3 That leaves security vendors, which can use the pre-execution hooks that many harnesses already support. This option works today without waiting for anyone else.11

The community response has started along those lines. The detection rule proposed for the Telltale project flags agent tool calls that launch, install or configure any archived reference server. Its authors are open about its gaps: it misses native file writes in Claude Code and OpenCode, GUI-based setup, Docker images, and forks republished under new names.14

Glow's practical advice is straightforward. Teams should search MCP configs for references to the deprecated @modelcontextprotocol servers, switch to the service owner's server where one exists, approve one server per service, and make npm deprecation status part of the approval process.11 This fits earlier advice to allowlist MCP servers through managed settings and review mcp.json after every install.16

The verdict

The main lesson of MCPhantom is not about four bugs in old Anthropic code. It shows that AI coding agents now make supply-chain decisions using a snapshot of the ecosystem that may be more than a year out of date. Package registries, archive notices and deprecation flags were designed for people, and agents can ignore all of them. Until harnesses enforce deprecation status or organizations install their own checks, the safest assumption is that any MCP server an agent chose by itself is a dependency nobody reviewed. These servers can stay installed and unmaintained for a long time without anyone noticing.