# MCPhantom: agents install deprecated MCP servers with unpatched RCE

> MCPhantom is Glow Labs' name for AI coding agents installing archived MCP reference servers that their training data still remembers.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Supply chain, Vulnerability
- **Published by:** Glow Labs
- **Disclosed:** 2026-11-02
- **Affects:** Claude Code, Cursor, Codex CLI, Claude Cowork, @modelcontextprotocol/server-puppeteer
- **Research by:** Nadav Claude Cohen, Glow Labs Research Team (Glow Security)
- **Primary source:** https://www.glow.io/blogs/mcphantom-ai-coding-agents-are-installing-vulnerable-deprecated-mcp-servers-from-training-data
- **Page:** https://theinjection.dev/items/glow-mcphantom/

AI coding agents pick deprecated Model Context Protocol servers out of their training data and install them, Glow Labs reports. The archived servers carry four high-severity flaws, including a prompt-injection RCE, and no fix is coming.

## What happened

Glow Labs published MCPhantom on November 2, 2026, after reviewing real coding sessions in which agents set up deprecated Model Context Protocol servers. In 98% of those sessions the agent supplied the old package name itself, and in the remaining 2% the user asked for it by name. Researcher Nadav Claude Cohen reports four high-severity flaws in the archived @modelcontextprotocol reference servers, including remote code execution in the Puppeteer server.

## How it works

Archived reference servers were popular when today's models were trained, so a model asked to add an MCP integration reaches for the name it knows instead of checking which server a service now ships. The install succeeds because npm still serves deprecated versions. In the Puppeteer server, a prompt injection can make the agent launch any process instead of a browser, and the harness allows it because the developer already granted web-browsing permission, which covers any command.

## Who is affected

Developers running Claude Code, Cursor, Codex CLI, Claude Cowork or Claude chat are exposed, across models from Anthropic, OpenAI and xAI. Glow Labs counted 17,352,267 npm downloads of the deprecated servers since July 10, 2025, and five of them sit in npm's top MCP 100. EDR, software composition analysis and software inventory tools generally do not flag these servers.

## What to do

Search developer machines for MCP configurations that name deprecated @modelcontextprotocol servers, and replace them with the server each service owner publishes. Approve one MCP server per service so agents have no outdated option to fall back on, and add npm deprecation status to the approval criteria.

## Quick facts

- **Affected:** Claude Code, Cursor, Codex CLI, Claude Cowork, Claude chat
- **Vulnerable packages:** Archived @modelcontextprotocol reference servers, including server-puppeteer
- **Flaws:** Four high severity, one remote code execution via prompt injection
- **Fixed in:** No fix. Repository archived May 29, 2025, maintainers say no release will come
- **Downloads:** 17,352,267 on npm since July 10, 2025
- **Found by:** Nadav Claude Cohen, Glow Labs
- **Status:** Reports closed as out of scope. No exploitation observed

## Questions

### Am I running a deprecated MCP server?

Check every MCP configuration on developer machines for package names beginning with @modelcontextprotocol/server-, such as server-github, server-postgres, server-slack, server-puppeteer or server-brave-search. Glow Labs reports that agents add these without telling the user, so the configuration file is the reliable place to look rather than the chat transcript. Thirteen of Anthropic's twenty 2024 reference servers are now archived.

### Will the deprecated MCP servers be patched?

No patch is planned. The maintainers archived the reference server repository on May 29, 2025, and told Glow Labs the Puppeteer server "is unmaintained, so no fix or release will come from this repository." They closed the report as out of scope and said they would consider marking the npm packages deprecated, which does not stop installation.

### Has the Puppeteer MCP server flaw been exploited?

Glow Labs says it has seen no exploitation of these flaws so far. The Puppeteer remote code execution needs a prompt injection to reach the agent, for example through a web page the agent visits. Because the developer granted web-browsing permission, the harness does not block the resulting command, so detection has to come from monitoring what the agent runs.

### Is there a CVE for the MCPhantom flaws?

No CVE has been published for the four flaws. Glow Labs reported one through HackerOne on July 30, 2026, which closed it as out of scope and pointed to GitHub, then reported all four to Anthropic's CNA between October 4 and 11, 2026. The maintainers closed the resulting advisory in October 2026, stating that no fix would come from the archive.

## Sources

1. [Glow Labs Report](https://www.glow.io/blogs/mcphantom-ai-coding-agents-are-installing-vulnerable-deprecated-mcp-servers-from-training-data)
2. [Archived MCP Servers](https://github.com/modelcontextprotocol/servers-archived)