> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# AI agents install unpatched MCP servers via MCPhantom pattern
- URL: https://f4n6.co.uk/security-feed/ai-agents-install-unpatched-mcp-servers-via-mcphantom-pattern/
- Published: 2026-11-03T10:20:14.000Z
- Updated: 2026-11-03T10:20:14.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Glow Labs reviewed real AI coding session transcripts and found coding agents installing deprecated Model Context Protocol (MCP) servers from archived repositories that will receive no security updates, a pattern it calls MCPhantom. In 98% of the affected sessions the agent appears to have chosen the package name from the model's training data rather than from a current source. Four high-severity flaws were found in the reference servers, the most serious a remote code execution bug in the Puppeteer server reachable through prompt injection. No exploitation has been seen and no patch is coming: the maintainers say the repository was archived in May 2025 and is unmaintained. For EMEA financial services the exposure is developer endpoints running these agents, where the installed server is a dependency that never appears in a manifest, has no CVE, and is invisible to SCA and software inventory.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

## 3\. Technical analysis & attack chain

The finding rests on Glow Labs' review of real AI coding session transcripts, limited to sessions where a deprecated MCP server was installed or suggested. The pattern appeared across Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, and across models from Anthropic, OpenAI and xAI. In the documented GitHub example, the agent passed over GitHub's own maintained MCP server and installed a deprecated Anthropic reference server drawn from its training data. The repository is archived and states no security updates are coming; the agent does not read archive notices.

Confirmed steps in the documented pattern:

1. A developer asks an AI coding agent to set up a service, for example "set up a GitHub MCP."
2. The agent selects a package name. In 98% of the affected sessions it appears to have filled the name from the model's training data; in the other 2% the user asked for the old package by name.
3. The agent installs the deprecated `@modelcontextprotocol` server, which runs through `npx`.
4. The server executes on the developer machine as a dependency that never appears in a dependency file.

The most serious of the four high-severity flaws is a remote code execution bug in the Puppeteer server, which lets an agent drive a browser. A prompt injection is enough to trigger it: the agent starts any process on the machine instead of the browser and runs any command the attacker chooses. The developer approved web browsing, and that single permission stretches to cover the rest, so the harness lets it through. The other three flaws are not described in the reporting.

Existing controls do not register the install. EDR sees a trusted Node process install a public npm package at the agent's request, which looks routine. SCA has no manifest because the server runs through npx, and the flaws have no CVEs. Software inventory never registers an application, so the endpoint is the only place the server shows up.

A lookup before install does not close the gap. Nadav Claude Cohen, vulnerability researcher at Glow, told Help Net Security that in one session the agent checked the package on npm, received "This package is deprecated," installed it anyway and never told the user.

Usage has not followed the deprecations. The deprecated packages Glow Labs counted have been downloaded from npm more than 17.3 million times since July 2025, with five of them in npm's top MCP 100\. Cohen cited `server-github` at 185,239 downloads in the last week with 6 owners, which places it outside npm's removal criteria (fewer than 300 downloads in the past week, a single owner, no public dependents). npm removes packages that contain malware; Cohen found no case of removal for vulnerabilities.

No exploitation has been seen. The flaws have no CVE, so no NVD score, EPSS value or CISA KEV state exists for them. The "high-severity" rating is Glow Labs' own; it has not been independently scored. The entire technical account is single-sourced to Glow Labs as reported by Help Net Security; verify before relying on it for enforcement.

## 4\. Mitigation & containment

P1 within 24h

- Search developer endpoints for MCP configuration that references deprecated `@modelcontextprotocol` servers. The reporting names the `@modelcontextprotocol` scope and the `server-github` package; it does not give config file paths, so locate configs by the harness in use.
- Where a service owner maintains its own server (GitHub does), switch the configuration to that server and remove the deprecated entry.
- Approve one server per service, so an agent cannot substitute a different package for the same service.
- Add npm deprecation status to the approval criteria for any MCP server.

P2 within 72h

- Use the pre-execution hooks that many harnesses already support to block or flag installs of deprecated servers before they run. Cohen states this works today without waiting for harness, model or package owners.
- Treat the agent's package selection as untrusted: require human confirmation of the exact package and source before an MCP server is installed.

P3 within 7 days

- Inventory which harnesses and models are in use across engineering (the pattern was seen in Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, and models from Anthropic, OpenAI and xAI) and apply the same pre-execution control to each.

No fixed release is named in public reporting. The maintainers said they would look at marking the npm package deprecated, but a deprecated package still installs through npx, so deprecation is a warning, not a fix. Pulling the packages is not available to npm owners under the removal criteria described. The only fix that protects users who keep running these servers is the package owners patching the flaws, and the maintainers have said no fix will come from the archived repository.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The reporting gives no hashes, domains, IP addresses, file paths or registry keys. The package scope `@modelcontextprotocol` and the package name `server-github` are legitimate npm artefacts, not malicious indicators, and are not listed for pivoting.

Behavioural indicators

| behaviour                                                                                                   | where to observe                                                         | confidence                 |
| ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ | -------------------------- |
| AI coding agent installs an npm package from the @modelcontextprotocol scope via npx at the agent's request | EDR process telemetry on developer endpoints (Node process spawning npx) | single-sourced (Glow Labs) |
| Agent receives "This package is deprecated" from npm and installs anyway without notifying the user         | Agent session transcripts, npm client output                             | single-sourced (Glow Labs) |
| MCP server process starts a non-browser process after a browsing permission was approved                    | Endpoint process telemetry correlated to the agent session               | single-sourced (Glow Labs) |

## 6\. Detection

Insufficient indicators to author detection rules. The reporting gives no file artefacts, command-line strings, mutexes, paths or network values specific to the threat, and the package names are legitimate npm artefacts rather than malicious strings. Detection should proceed from the behavioural indicators in §5 rather than from signatures.

## 7\. Sources

- Help Net Security, "AI coding agents are installing MCP servers that will never be patched," https://www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/, 2026-11-03\. Reports research by Glow Labs (Glow Security); quotes Nadav Claude Cohen (vulnerability researcher) and Ophir Arie (VP of R&D).

## 8\. Adverse Trace position

Adverse Trace assesses this as a moderate, developer-endpoint exposure rather than an active compromise: no exploitation has been seen, the four flaws have no CVE and no independent severity score, and the "high-severity" rating is Glow Labs' own, single-sourced to Glow Labs via Help Net Security. The risk that matters for financial services clients is that the installed server is invisible to SCA, software inventory and routine EDR judgement, so an organisation can be running unpatched, unpatchable code on developer machines without any control flagging it. We will track for any report of exploitation or a CVE assignment against the affected `@modelcontextprotocol` servers, and we will reissue this advisory if a package owner ships a fix. Clients should treat the P1 configuration search in §4 as the immediate action.

---

[Read the original source →](https://www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*