[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Context & Harness Attacks · markdown

official (Glow Labs research, Nov 2-3). Vendor research; the four flaws have no CVEs and only the Puppeteer RCE is described; no exploitation seen

MCPhantom: coding agents install archived Anthropic MCP reference servers from memory, including a Puppeteer server with an unpatched prompt-injection-to-RCE bug

  • Scale (Glow, npm counts since Jul 10, 2025): 17.35M downloads across 12 deprecated packages, led by server-github (5.27M), server-postgres (4.31M), server-slack (3.20M), server-puppeteer (1.49M) and server-brave-search (1.46M).
  • Why tools miss it: servers launched via npx aren't in any project manifest (so SCA doesn't see them), don't appear as installed apps, and npm deprecation only removes them from search; npx still installs them with a warning.

What to do: search developer machines' MCP configs (Claude, Cursor, Codex and similar) for @modelcontextprotocol/server-* packages and replace them with the service owner's own server; standardize one approved MCP server per service; add npm deprecation status to MCP approval. In agent instructions, pin the exact approved package names so the model doesn't fill them in from memory.

Sources: Glow Labs: MCPhantom: AI coding agents are installing vulnerable deprecated MCP servers from training data · Help Net Security: AI coding agents are installing MCP servers that will never be patched (Nov 3)