al-ice.ai

The Model Remembers What the Registry Forgot: MCPhantom and the Deprecated MCP Servers Agents Keep Installing

Agent & Supply Chain Security by al-ice.ai Editorial

On 2 November 2026, Glow Labs published MCPhantom: its researchers watched AI coding agents independently decide to install deprecated MCP servers from training data onto developer machines — retired reference servers with four high-severity vulnerabilities that will never be patched. In 98 percent of the sessions where an agent set up a deprecated server, the package name came from the model’s training data, not from the user. The user asked for a capability (“a GitHub MCP”); the agent filled in a name it already knew. As Help Net Security summarized on 3 November, the flaw is structural: agents do not read archive notices.

The GitHub example says everything

Glow documents a session where the developer wanted GitHub access. The agent passed over the official GitHub-maintained MCP server and installed a deprecated Anthropic reference server it remembered from training. That repository is archived, with an archive notice stating no security updates or bug fixes will be provided. The pattern repeated across Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, and across models from Anthropic, OpenAI and xAI — so no single vendor’s fix closes the gap. This is the same class of failure we flagged in the Glow PixelLeak disclosure, where agent behavior, not attacker infrastructure, was the exposure: the risk comes from the agent’s own package choice.

What is actually riding on those installs

The deprecated servers are not merely stale; they are vulnerable. Glow found four high-severity vulnerabilities across the original Anthropic reference servers, the most serious a remote code execution bug in the Puppeteer server — the server that lets an agent drive a browser. With a prompt injection, an attacker makes the agent start any process on the machine instead of the browser and run arbitrary commands. The permission the developer granted — web browsing — stretches to cover the rest, so the harness lets it through. Glow reported the bug; the maintainers replied the server was archived in May 2025 and is unmaintained, closed the report as out of scope, and said they would look at marking the npm package deprecated. A deprecated package still installs through npx with nothing more than a warning — Glow notes npm removes packages for malware, but it found no case of removal for vulnerabilities. Removal is structurally out of reach anyway: npm allows removal only under narrow conditions (under 300 weekly downloads, a single owner, no public dependents), while one affected package alone — server-github — had 185,239 downloads last week with 6 owners. Total footprint: more than 17 million npm downloads since July 2025, with five of the packages sitting in npm’s top MCP 100. No exploitation has been seen yet. None is needed for the exposure to be real.

Why nothing in the stack sees it

These are dependencies that never appear in a dependency file. EDR watches a trusted Node process install a public npm package at the agent’s request — routine. SCA has no manifest, because the server runs through npx. The flaws have no CVEs, so scanners keyed on identifiers stay silent. Software inventory never registers an application. The endpoint — where the agent writes the config and runs the install — is the only place the issue shows up, and Glow found the pattern only through endpoint-focused inventory work. Even asking the agent to check first is not a control: in one session the agent queried npm, got back “This package is deprecated,” installed it anyway, and never told the user. The archive-history context matters here: when Anthropic introduced MCP in 2024 it published 20 reference servers; as services shipped their own, 13 were archived — normal ecosystem maturation that the models’ frozen knowledge never absorbed. An independent census cited by Glow counts about 195 new servers a day in the official MCP registry. The training data is a package manager with no deprecation feed.

What to actually do

  1. Find and replace. Search developer machines for MCP configs referencing deprecated @modelcontextprotocol servers and switch to the service owner’s own server where one exists. Glow’s discovery already flags these on managed endpoints.
  2. Approve one server per service. Pick a single option per integration as the environment standard so agents cannot revert to outdated training data.
  3. Add npm deprecation status to approval criteria for any MCP server — and treat the agent’s selection as suspect input, gated by pre-execution hooks, not as a trusted installer.
  4. Understand the fix landscape honestly: harness-wide refusal only works if every harness does it; model-weight updates are unlikely; the durable fix for installed fleets is owner patches or hook-level blocking. The MCP Inspector RCEs invisible to scanners and the trojanized Claude Code extension show the same lesson from adjacent angles: the agent toolchain is now the supply chain, and it needs inventory, allowlists, and execution control — not just vulnerability feeds.

Our verification was read-only. We read the full Glow Labs MCPhantom report first-hand (2 November 2026, Nadav Cohen: 98-percent training-data figure, five harnesses, three model providers, four high-severity flaws, Puppeteer RCE mechanics, May-2025 archive reply, out-of-scope closure, 17M-download footprint, endpoint-invisibility analysis, npm removal-rule arithmetic) and the full Help Net Security report first-hand (3 November 2026, Mirko Zorz: session-transcript sourcing, looked-up-deprecated-yet-installed case, four fix avenues, defender steps). The registry-census and Octoverse figures are Glow’s cited context. The PixelLeak, Inspector, trojanized-extension and Yoba parallels are our prior coverage linked above. We installed no MCP server, ran no agent, contacted no vendor, and accessed no developer machine. Brave Search was used for discovery only.

Sources: