AI agents install vulnerable archived MCP servers instead of...

AI agents install vulnerable archived MCP servers instead of official ones

Glow Labs researchers described the MCPhantom pattern: in 98% of tracked sessions, AI coding agents (Claude Code, Cursor, Codex CLI, Claude Cowork, Claude Chat) select outdated archived @modelcontextprotocol packages from training data when connecting to an MCP server. These packages contain 4 high-severity vulnerabilities, including RCE in server-puppeteer via prompt injection.

Compiled by Sergey KostenchukPublished 2026-11-04Updated 2026-11-04

2026-11-04 Safety Anthropic

🛡 AI agents install vulnerable archived MCP servers instead of official ones

Glow Labs researchers described the MCPhantom pattern: in 98% of tracked sessions, Claude Code, Cursor, and Codex CLI agents select outdated @modelcontextprotocol packages instead of official servers. These packages contain 4 high-severity vulnerabilities, including RCE in server-puppeteer via prompt injection; the servers were archived in May 2025, and no patches will be issued.

🌍 Since July 10, 2025, the outdated packages have been downloaded 17.35 million times from npm. The servers run via npx, making them invisible to EDR, SCA, and software inventory tools.

👤 Check your MCP configs for @modelcontextprotocol/server-* — the agent may have installed an archived vulnerable server on its own. Replace them with official servers from service owners.

Source 1: https://www.glow.io/blogs/mcphantom-ai-coding-agents-are-installing-vulnerable-deprecated-mcp-servers-from-training-data

Source 2: https://www.helpnetsecurity.com/2026-11-03/mcphantom-deprecated-mcp-servers/

Sources