Your AI Coding Assistant May Be Installing Abandoned Software: The MCPhantom Findings at a Glance
Research from Glow Labs shows AI coding agents picking deprecated, unmaintained MCP servers from memory, including one with a remote code execution flaw that will never be fixed. A spec sheet on the problem and a checklist for teams using AI agents.
When a developer asks an AI coding agent to connect to a service, the agent has to choose which add-on, or MCP server, to install. New research shows it often chooses from memory, and its memory is out of date.
Our summary relies on Help Net Security’s interview-based report on research from Glow Labs.
Spec sheet: the MCPhantom problem
- What it is: AI coding agents installing Model Context Protocol (MCP) servers from archived repositories that will not receive security updates. Glow Labs calls the pattern MCPhantom.
- Why it happens: in 98% of the sessions Glow Labs reviewed where a deprecated server was installed or suggested, the agent appears to have supplied the package name from its training data. In the other 2%, the user asked for the old package by name.
- Example: asked to set up GitHub access, an agent passed over GitHub’s own MCP server and installed an archived reference server instead.
- Where it was seen: Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, using models from Anthropic, OpenAI and xAI.
- The flaws: four high-severity vulnerabilities in the old reference servers. The worst, in the Puppeteer browser server, lets a prompt injection start any program and run any command the attacker chooses, riding on the developer’s permission to browse the web.
- Patch status: none coming. The report was closed as out of scope; maintainers said the server was archived in May 2025. They may mark the npm package deprecated, but deprecated packages still install.
- Scale: the deprecated packages counted have been downloaded more than 17.3 million times since July 2025, and five sit in npm’s top 100 MCP packages.
- Exploitation: none observed so far.
Why your existing tools miss it
These servers run on the fly through npx, so they never appear in a dependency file for software composition analysis to scan. Endpoint security sees a trusted Node.js process fetching a public package, which looks normal. The flaws carry no CVE numbers, and software inventory never registers an installed application. Even asking the agent to check first is not a fix: in one session the agent was told the package was deprecated and installed it anyway without mentioning it. The packages also cannot simply be pulled from npm, because its removal rules do not fit packages this popular.
Checklist for teams using AI coding agents
- Search developer machines and repositories for MCP configuration files that reference the deprecated @modelcontextprotocol servers.
- Where the service provider publishes its own MCP server, switch to it.
- Approve one MCP server per service and make that list part of your development standards.
- Add “is this package deprecated or archived?” to your approval criteria.
- If your agent tools support pre-execution hooks, use them to block unapproved installs.
- Treat the agent’s choice of software as a suggestion that needs review, not a decision.
What this means for your company
If anyone in your business writes code or builds automations with AI help, those assistants are now making software purchasing decisions on your behalf, and nobody is reviewing them. That does not mean banning the tools. It means writing down which add-ons are allowed, checking developer machines for the ones that are not, and making sure an AI agent cannot quietly install whatever it remembers.
Using AI coding tools in your business and unsure what they have installed along the way? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
