AI coding agents install unpatched deprecated MCP servers
Original title: AI coding agents are installing MCP servers that will never be patched
Glow Labs research found AI agents installing deprecated MCP servers in 98% of sessions, with four high-severity vulnerabilities including RCE, downloaded over 17.3 million times, no patches or exploitation seen.
AI coding agents pick archived deprecated MCP packages from training data when instructed to set up GitHub MCP. Glow Labs analyzed sessions across Claude Code, Cursor, Codex CLI and other tools, documenting the MCPhantom pattern where agents select unmaintained repositories. The reference servers contain flaws such as a Puppeteer RCE triggered by prompt injection that lets the agent execute arbitrary commands. Maintainers confirmed the packages are archived with no updates planned. Deprecated packages have been downloaded more than 17.3 million times since July 2025.
Unconfirmed: whether harness makers or model makers will implement controls or update knowledge bases
- Deprecated servers installed in 98% of sessions reviewed
- Four high-severity vulnerabilities in the servers
- Puppeteer RCE via prompt injection
- Packages downloaded 17.3M+ times
- No known exploitation or patches
Impact: remote code execution via prompt injection allowing arbitrary command execution
| Product | Affected |
|---|---|
| deprecated MCP servers | — |
| Puppeteer server | — |
- 1.add deprecation status to approval criteria
- 2.switch to owner-provided MCP server
- 3.approve single server per service
- Vendors
- Glow Labs
- Products
- MCP serversPuppeteer server
From the original article
3 min read at helpnetsecurity.com
When a developer tells an AI coding agent to “set up a GitHub MCP,” the agent has to pick a package. New research from Glow Labs documents sessions where it picked one out of an archived repository that will never be patched again. Source: Glow Security Reviewing real AI coding session transcripts, Glow Labs found deprecated MCP servers landing on developer machines, a pattern it calls MCPhantom.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.