---
title: MCPhantom: coding agents install archived Anthropic MCP reference servers from memory, including a Puppeteer server with an unpatched prompt-injection-to-RCE bug | ctxsec
url: https://ctxsec.com/items/glow-mcphantom-agents-install-deprecated-anthropic-mcp-reference-servers-puppeteer-rce
description: "Glow Labs reviewed real coding-agent sessions and found agents choosing deprecated @modelcontextprotocol reference servers (e.g. server-github instead of GitHub's own server) because the names were in their training data; in 98% of such sessions the user hadn't asked for the old package. It saw this across Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, and across Anthropic, OpenAI and xAI models. It reports four high-severity flaws in the archived servers, the worst a Puppeteer server bug where a prompt injection makes the agent launch any process instead of a browser. The maintainers said the archived repo won't get a fix."
status: "official (Glow Labs research, Nov 2-3). Vendor research; the four flaws have no CVEs and only the Puppeteer RCE is described; no exploitation seen"
published: 2026-11-03
---

> Glow Labs reviewed real coding-agent sessions and found agents choosing deprecated @modelcontextprotocol reference servers (e.g. server-github instead of GitHub's own server) because the names were in their training data; in 98% of such sessions the user hadn't asked for the old package. It saw this across Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, and across Anthropic, OpenAI and xAI models. It reports four high-severity flaws in the archived servers, the worst a Puppeteer server bug where a prompt injection makes the agent launch any process instead of a browser. The maintainers said the archived repo won't get a fix.

[← Context & Harness Attacks](/context) · [markdown](/items/glow-mcphantom-agents-install-deprecated-anthropic-mcp-reference-servers-puppeteer-rce.md)

official (Glow Labs research, Nov 2-3). Vendor research; the four flaws have no CVEs and only the Puppeteer RCE is described; no exploitation seen

2026-11-03

### MCPhantom: coding agents install archived Anthropic MCP reference servers from memory, including a Puppeteer server with an unpatched prompt-injection-to-RCE bug

- **Scale (Glow, npm counts since Jul 10, 2025):** 17.35M downloads across 12 deprecated packages, led by server-github (5.27M), server-postgres (4.31M), server-slack (3.20M), server-puppeteer (1.49M) and server-brave-search (1.46M).
- **Why tools miss it:** servers launched via `npx` aren't in any project manifest (so SCA doesn't see them), don't appear as installed apps, and npm deprecation only removes them from search; `npx` still installs them with a warning.

**What to do:** search developer machines' MCP configs (Claude, Cursor, Codex and similar) for `@modelcontextprotocol/server-*` packages and replace them with the service owner's own server; standardize one approved MCP server per service; add npm deprecation status to MCP approval. In agent instructions, pin the exact approved package names so the model doesn't fill them in from memory.

Sources: [Glow Labs: MCPhantom: AI coding agents are installing vulnerable deprecated MCP servers from training data](https://www.glow.io/blogs/mcphantom-ai-coding-agents-are-installing-vulnerable-deprecated-mcp-servers-from-training-data) · [Help Net Security: AI coding agents are installing MCP servers that will never be patched (Nov 3)](https://www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/)