AI Coding Agents Install Unpatchable Deprecated Servers, Creating 'MCPhantom' Risk
AI coding agents are installing deprecated MCP servers due to outdated training data, a pattern dubbed MCPhantom, leaving systems vulnerable to unpatched, high-severity exploits.
New research from Glow Labs reveals a concerning trend where AI coding agents, when prompted to set up GitHub MCP servers, are selecting outdated and unmaintained packages from their training data. This pattern, dubbed 'MCPhantom,' leads to the installation of deprecated servers that will never receive security updates, leaving developers' systems exposed to significant risks.
In a detailed analysis of AI coding session transcripts, Glow Labs observed that in 98% of instances where a deprecated server was installed or suggested, the AI agent selected a package from its training data rather than a current, maintained version. For example, one agent bypassed GitHub's own MCP server in favor of an archived Anthropic reference server, ignoring the repository's archived status and lack of future security updates.
The issue spans multiple AI coding platforms and models, including Claude Code, Cursor, Codex CLI, Claude Cowork, Claude chat, and models from Anthropic, OpenAI, and xAI. This widespread adoption of outdated components highlights a fundamental challenge in the training and knowledge base of these powerful tools.
Compounding the problem, these deprecated servers harbor critical vulnerabilities. Glow Labs identified four high-severity flaws, including a remote code execution (RCE) bug in the Puppeteer server. This vulnerability can be triggered by a simple prompt injection, allowing an attacker to execute arbitrary commands on the developer's machine by leveraging the agent's approved web browsing permissions.
Despite the severity of these flaws, no patches are forthcoming from the original repositories, as they are archived and unmaintained. While some package maintainers might mark their npm packages as deprecated, this warning does not prevent installation via tools like npx. Worryingly, these deprecated packages have seen millions of downloads since mid-2025, with several ranking among npm's top 100 MCP packages.
Existing security controls are largely ineffective against this threat. These deprecated servers often function as dependencies that bypass standard dependency manifests, making them invisible to Software Composition Analysis (SCA) tools. Endpoint Detection and Response (EDR) solutions may view the installation as a routine process initiated by a trusted Node.js process, and since the flaws lack CVE identifiers, they are not flagged by vulnerability scanners.
Researchers suggest several potential solutions, including harness makers refusing deprecated servers, model providers updating their training data (though costly), package owners fixing the bugs (unlikely for archived projects), or security companies leveraging pre-execution hooks in harnesses. However, even an agent's own package lookup can be insufficient, as one observed instance showed an agent installing a deprecated package despite receiving a warning.
Security teams are advised to proactively identify and replace references to these deprecated servers in their MCP configurations, prioritizing official or maintained alternatives. They should also incorporate npm deprecation status into their approval criteria for software components. The core issue remains that AI models' memory is acting as a package manager without a robust deprecation feed, necessitating a more cautious and controlled approach to AI-assisted development.