> status: mostly fine. patch anyway.practical AI security · est. 2026

Brief · Both

Your coding agent is installing MCP servers from memory, and some of them were retired last year

By alkizz ·

On Nov 3, Glow Labs (Glow Security) published research it calls "MCPhantom", and the short version is that AI coding agents keep setting up Anthropic's old @modelcontextprotocol/* reference servers, which were archived in May 2025 and now carry a deprecation notice on npm. Glow went through real coding-session transcripts across Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, with models from Anthropic, OpenAI and xAI, and the agents kept reaching for packages nobody maintains anymore. The worst of them, by Glow's account, is the Puppeteer server, which has a prompt-injection bug that can turn "open a browser" into "run whatever the attacker wants". There's no fix coming and no CVE, but there's also no sign anyone is exploiting it, so this is a config cleanup and not a fire drill.

What Glow found

In 98% of the sessions where an agent installed or suggested a deprecated server, Glow says the agent appears to have picked it because the name was in its training data, and in the other 2% the user asked for the old package by name. That 98% is of those sessions only, not of all agent sessions, and Glow doesn't say how many sessions it looked at. Still, the pattern makes sense to me. These servers were the official examples for a long time, so of course the models learned them, and nobody gave the models a memo when they were retired.

Glow says it found four high-severity flaws in these servers, and "high-severity" is Glow's own rating since there's no CVE or CVSS behind it. Only one is described publicly. In the Puppeteer server, Glow says, "with a prompt injection, an attacker can make the agent start any process on the machine instead of the browser and run any command." I haven't seen independent confirmation or technical detail beyond that, and Glow hasn't named the other three, so I won't guess at them.

The fix situation is simple, because there isn't one. The servers moved to the modelcontextprotocol/servers-archived repo in May 2025, and its README says "No security updates or bug fixes will be provided". Glow reported the Puppeteer bug. Glow says the maintainers replied that the server was archived in May 2025 and "is unmaintained, so no fix or release will come from this repository." Glow also reported all four flaws to Anthropic's CNA in early October. As of Nov 3 there's no CVE and no published GitHub advisory for any of them.

About that 17.3 million

The number going around is that these packages were downloaded from npm more than 17.3 million times since July 2025. That's Glow's total across 12 packages since Jul 10, 2025, and one of the 12 (create-server) is a scaffolding tool, not a server at all. Most of the total is server-github and server-postgres. The Puppeteer server, the one with the described RCE, is about 1.5 million of it. And downloads aren't installs or people, since CI jobs and mirrors count too. So 17.3M is a fair measure of how popular the old servers still are, but it's not a count of machines exposed to the RCE.

The popularity part is real, though. server-github alone had 185,239 downloads in the week of Oct 22–28, more than a year after it was archived.

Why your tools don't see it

These servers usually run through npx, so they never land in a package.json or lockfile. Glow says EDR, SCA and software inventory tools don't see them, and that the endpoint is the only place they show up. npm's deprecation notice doesn't stop them either, because npx will still install a deprecated package with nothing more than a warning, and Glow quotes an agent getting back "This package is deprecated." during setup. A warning is only useful if something reads it and stops.

Glow's Nadav Claude Cohen put it as "A lookup before install is not enough on its own", and Ophir Arie, Glow's VP of R&D, had the line I'll remember: "The model's memory is now a package manager with no deprecation feed."

What to do:

Sources

Related

On the checklist

More briefs

← All briefs