VULNpocalypse
MediumSupply chainMonitoring

Glow Labs reports AI coding agents install deprecated, unpatched MCP servers

Glow Labs reports AI coding agents installing archived MCP servers with unpatched flaws. Audit MCP configs and switch to maintained servers.

Published
Exploitation
No, Help Net Security reports that no exploitation has been seen yet

What happened

Research from Glow Labs, reported by Help Net Security, says AI coding agents are installing deprecated Model Context Protocol (MCP) servers on developer machines. Glow Labs calls this pattern MCPhantom. These are findings from one research team as covered by one outlet. Independent verification is not confirmed.

Glow Labs reviewed real AI coding session transcripts. It looked only at sessions where a deprecated server was installed or suggested. According to the research, in 98% of those sessions the agent appears to have taken the package name from the model’s training data. In the other 2%, the user asked for the old package by name (Help Net Security).

Glow Labs gives an example. GitHub maintains its own MCP server, but when the agent was asked to set up a GitHub MCP, it chose a deprecated Anthropic reference server instead. That repository is archived and says no security updates are coming. Glow Labs reports the same pattern across Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, using models from Anthropic, OpenAI and xAI (Help Net Security).

Glow Labs says it found four high-severity vulnerabilities in these reference servers. It describes the most serious as remote code execution in the Puppeteer server, which lets an agent drive a browser:

  • According to Glow Labs, a prompt injection can make the agent start any process on the machine instead of the browser and run attacker-chosen commands.
  • The developer’s approval of web browsing is reportedly enough for the harness to let this through.

The flaws have no CVEs, according to the report (Help Net Security).

Glow Labs says its report was closed as out of scope. The maintainers replied that the server was archived in May 2025 and is unmaintained, so no fix will come from that repository. They said they would look at marking the npm package deprecated, but Glow Labs notes that a deprecated package still installs through npx (Help Net Security).

Glow Labs counted the following download figures, as Help Net Security reports:

  • The deprecated packages have been downloaded from npm more than 17.3 million times since July 2025.
  • Five of them are in npm’s top MCP 100.
  • Glow researcher Nadav Claude Cohen says server-github had 185,239 downloads in the previous week and has 6 owners. This means it does not meet npm’s criteria for owner removal: fewer than 300 weekly downloads, a single owner and no public dependents.

Cohen also told the outlet that a lookup before install is not enough on its own. In one session, the agent checked npm, was told the package was deprecated, installed it anyway and did not tell the user.

Am I affected?

According to Glow Labs, you may be affected if all of the following apply:

  • You use an AI coding agent or harness such as Claude Code, Cursor, Codex CLI, Claude Cowork or Claude chat.
  • Your MCP configuration references deprecated @modelcontextprotocol reference servers, such as the Puppeteer or GitHub servers.

Glow Labs says these servers are easy to miss with existing tools (Help Net Security):

  • They run through npx, so they never appear in a dependency file.
  • SCA tools have no manifest to scan.
  • EDR sees a routine npm install by a trusted Node process.
  • Software inventory does not register an application.

The endpoint is the only place they show up.

The full list of affected packages and the details of all four flaws are not confirmed in the source.

What to do now

These steps are the ones Glow Labs suggests, as reported by Help Net Security:

  1. Search developer endpoints for MCP configs that reference deprecated @modelcontextprotocol servers.
  2. Replace them with the service owner’s own MCP server where one exists, for example GitHub’s server instead of the archived reference server.
  3. Approve one server per service.
  4. Add npm deprecation status to your MCP server approval criteria.
  5. If your harness supports pre-execution hooks, consider using them to block deprecated servers. Cohen says this works today without waiting for harness makers, model makers or package owners.
  6. Do not rely on the agent checking npm before installing. Glow Labs observed an agent install a package after npm reported it as deprecated.

Sources