MCPhantom: AI Coding Agents Are Installing Vulnerable Deprecated MCP Servers From Training Data

The Glow Labs research team has identified AI coding agents independently deciding to install deprecated MCP servers, potentially exposing organizations to high-severity vulnerabilities in servers that no longer receive security updates.

Glow Labs calls this pattern MCPhantom where retired MCP servers keep turning up on developer machines.

Our research team uncovered this pattern while monitoring risky agentic behavior, tracking activities, identifying MCP installs, and assessing agentic decision making processes.  

In 98% of the sessions where an agent set up a deprecated MCP server, it appears that reason for it being selected is because it was previously used in the model's training data.

So that when the user asked for a capability, such as "a GitHub MCP," and the agent filled in the name based on what it already "knew" from the past and not because it was the official or most up-to-date MCP available.

In the other 2%, the user asked for the deprecated package by name and the agent obliged.

In the GitHub example, instead of the official MCP server that GitHub maintains, the agent chose a deprecated Anthropic server that it remembered from its training data instead of looking for the latest secure version.

That server's repository is archived, and its archive notice says no security updates or bug fixes will be provided.

For security teams, this represents a significant risk, because software is landing on developer machines based on an agent's training data, with little to signal that it's no longer maintained.

Meanwhile, agents are not going to pay much attention to the archived notices so even when they are clearly marked, the risk remains.

What did Glow Labs find?

Glow Labs reviewed real-world AI coding session transcripts and found sessions in which an agent set up deprecated local Anthropic MCP servers that were running on the endpoints.

Due to the MCP servers running locally, they had not previously shown up in other scans and only were uncovered when local assets were discovered in the course of an endpoint-focused inventory research.

Here's how a developer's request turned into a deprecated install:

1. A developer asks the agent to connect a service, such as GitHub.
2. The agent fills in the name of an early reference server from its training data.
3. It either writes the MCP config itself or hands the developer the command, and then npm installs the deprecated package.

The same pattern showed up in every tool and with every model provider in the data, so no single vendor's fix would close the gap:

• Agent harnesses: Claude Code, Cursor, Codex CLI, Claude Cowork, and Claude chat
• Model providers: Anthropic, OpenAI, and xAI

Then the team looked at what the agents had actually installed, and that's where the findings get more serious:

• Four high-severity vulnerabilities were uncovered, including a remote code execution vulnerability in the Puppeteer server, across the original deprecated servers created by Anthropic when they launched MCP
• They are very widely used with 17M npm downloads since July 2025 across Anthropic's deprecated reference servers, with five of them in npm's top MCP 100
• No fixes are coming, as in at least one case, the maintainers have confirmed that they will not be involved moving forward

Why do agents keep choosing deprecated servers?

None of these sessions involved a malicious actor. Instead, the risk came from the agent's own choice of package, based on what it learned during training.

A fast-growing ecosystem leaves old servers behind

The AI tooling ecosystem is growing quickly, and that growth means a lot of turnover.

An independent census of the official MCP registry by researcher Haseeb Mohammed Afsar counted about 195 new servers a day, and GitHub's Octoverse 2025 report counted 4.3 million AI-related repositories.

The history of MCP itself is a good example. When Anthropic introduced it in 2024, it published 20 reference servers to show developers how to build integrations.

As most of the services built servers of their own, 13 of those reference servers were archived, which is a normal part of a maturing ecosystem.

Once GitHub and the other services shipped their own servers, there was little reason for Anthropic to keep maintaining duplicates.

That also means no one is left to fix them, as the maintainers' reply on the Puppeteer server shows.

These Agents worked from training data, so finding the current package is not on the agenda

A model learns which package name to use when it wants an MCP server for GitHub. Whether that name has since been deprecated isn't part of its training.

Deprecation on npm doesn't close the gap either. A deprecated package disappears from npm search , which may explain why most web searches came up empty, but npx will still install it with nothing more than a warning.

Why existing controls weren't built to catch deprecated MCP servers

Simply put, these MCP servers are dependencies that never show up in a dependency file, so the tools built to watch dependencies don't see them.

That leaves the endpoint, where the agent writes the config and runs the install, as the one place this issue shows up.

What can an attacker do with these servers?

The most serious of the four vulnerabilities is a remote code execution (RCE) bug in the Puppeteer server, which lets an AI agent open a browser session.

• What it allows: with a prompt injection, an attacker can make the agent start any process on the machine instead of the browser and run any command.
• Why safeguards miss it: the developer allowed the agent to browse the web, and that permission ends up covering any command, so the agent harness doesn't stop it.

Glow Labs reported the bug. The maintainers replied that the server was archived in May 2025 and "is unmaintained, so no fix or release will come from this repository." They closed the report as out of scope and said they would look at marking the npm package deprecated so users are warned.

At this point, Glow Labs hasn't seen anyone exploit these vulnerabilities yet. However, with no patch coming, the door stays open. And given the concerns raised by AI-powered bug hunting, the chances of these vulnerabilities being discovered have risen substantially.

What should security teams do now?

Security teams can take these steps with the tools they already have:

• Find and replace the deprecated servers. Search developer machines for MCP configs that reference the deprecated @modelcontextprotocol servers, and switch to the service owner's own MCP server where one exists.
• Approve one MCP server per service. Pick a single option for each service and make it the standard for use across your environment to ensure that agents don't revert to outdated training models.
• Check deprecation before approval. Add npm deprecation status to the criteria for approving any MCP server.

What should Glow customers do?

Glow customers can find every deprecated MCP server on their developer machines with one request. Glowy, Glow's AI platform agent, works from an inventory of the agent plugins and MCP servers on each managed developer machine, across more than 20 AI tools.

Here's how a security engineer would use it:

1. Check your issues. Glow's discovery and Glow Labs research have already flagged any deprecated MCP servers with known vulnerabilities on your endpoints, so any MCPhantoms on your endpoints are already waiting in your issues.
2. Ask. "Which endpoints have a deprecated @modelcontextprotocol server configured?" Glowy returns the endpoints, the servers, and their versions.
3. Remove. After the engineer approves, Glowy deletes the MCP server's config entry on each endpoint.
4. Keep it off the fleet. Set a policy based on npm deprecation status, and Glow flags every deprecated server on every endpoint at the next scan, including new installs.
5. Block and steer the agent. When an agent tries to use a deprecated server, Glow blocks the call and steers the agent toward the approved server instead.
6. Point developers to the replacement. Glowy can email affected developers, message them on Slack, or open a Jira or ServiceNow ticket.

Glow can also block calls to risky MCP servers with a policy, so agents can't use them even after they're installed.

Which package will your agents reach for next?

AI tools will keep changing faster than any team can track by hand, and packages will keep getting retired after the models that recommend them were trained.

As we covered in our PHP2Shell post, researchers used AI to find vulnerabilities that had sat in PHP for more than a decade. Attackers are going to keep pointing newer models at key code bases that we consider to be safe and depend on for our software, so leaving deprecated code on developer machines that no one will patch.

"The model's memory is now a package manager with no deprecation feed," said Ophir Arie, Glow co-founder and VP of R&D, "And this means that we're going to have to change our approach to how we think about risk in our AI environments to one that views the agent's decision-making process as suspect and in need of controls."

Disclosure timeline