Glow Labs researchers described the MCPhantom pattern: AI coding agents, in 98% of tracked sessions when asked to connect an MCP server, install archived @modelcontextprotocol packages from the model's training data instead of current official servers. Four high-severity vulnerabilities were found in these abandoned servers, including remote code execution, and no fixes will be released for them. Since July 10, 2025, such packages have been downloaded from npm 17.3 million times, and for standard security tools, agent-based installation remains invisible.

!image(2).png)

image
image

What happened

Glow Labs published an analysis of the pattern named MCPhantom. The authors tracked how AI coding agents — Claude Code, Cursor, Codex CLI, Claude Cowork, and Claude Chat — execute a request to connect an MCP server: in 98% of tracked sessions, the agents chose outdated archived @modelcontextprotocol packages rather than current official servers for the respective services. Four high-severity vulnerabilities were detected in the archived servers; the most severe is RCE in server-puppeteer, which allows running arbitrary processes on the developer's machine via prompt injection. The servers were archived in May 2025, so no patches will be released for these issues. The scale of the already formed installation base: since July 10, 2025, outdated packages have been downloaded from npm 17,352,267 times, including server-github — 5.27 million downloads, server-postgres — 4.31 million, server-slack — 3.20 million; five of them are in the top 100 npm MCP packages.

Context

MCP (Model Context Protocol) is an open protocol through which AI agents connect to external tools and services: code repositories, databases, messengers. The @modelcontextprotocol/server-* packages were originally reference servers from Anthropic; later, service owners released their own official servers, and the reference ones were archived and remained in the npm registry. The problem is that the agent resolves the MCP server name not by checking the live registry, but by memory: a plausible explanation for the observed choice is the priority of names more frequently encountered in the training corpus, so the model reproduces from the weights exactly the old package names. For the user, this looks like a standard integration connection: the agent finds the package and connects it itself, without reporting on the status and maintainability.

Why this matters for the industry

For the industry, MCPhantom is not a bug of a single harness, but a class of failure at the model level: the agent reproduces outdated package names from training data, and agent-based MCP server installation becomes an unauditable code execution path within a company. The blind spot is systemic: servers are launched via npx inside a Node process and do not appear in dependency manifests, so EDR, SCA, and software inventory do not see this channel, and standard telemetry is not suitable for measuring the problem — data can only be collected through pre-execution hooks. The material outlines directions for a response: pre-execution hooks in harnesses, a "one official MCP server per service" policy, and checking npm deprecation status when approving new servers. For builders, this is an early signal of a new product category — agent supply chain security: a vulnerable installation base already exists, but there are no MCP config scanners, configuration linters, or SDKs for checking packages before execution; the first evals on agent selection of current packages and independent replications of the study are likely.

Why this matters for users

If you use Claude Code, Cursor, Codex CLI, or other agents with MCP, the only available measure right now is manual configuration auditing: open your MCP configs, find links to @modelcontextprotocol/server-*, and check their status against the npm registry. The agent may have installed an archived package independently and without warnings — if this happened, a vulnerable server may already be running on the host. Such records should be replaced with official servers from service owners — for example, the official GitHub MCP server instead of the archived Anthropic reference. After checking, it makes sense to include in security processes a rule to check npm deprecation status when approving each new MCP server, and where the harness supports it, limit the agent's choice with an allowlist and pre-execution hooks.

What is currently unknown / limitations

The key metric — 98% of tracked sessions — is presented as an established fact, but the methodology is absent in open materials: the sample size in sessions, its structure (real telemetry or synthetic tests), and the distribution of agents and prompts are unknown. Until the methodology is published, the material should be read as a Glow Labs vendor report, not a reproducible study. The explanation of the mechanism by the frequency of names in the training corpus is plausible but empirically unverified. It is also unknown how many real hosts are currently running archived servers: the number of downloads from npm is not equivalent to the number of working installations.

Sources

Author

Look at AI, editorial team