AI coding agents keep installing archived MCP servers with known flaws because the models remember them, the security start-up Glow says

The security start-up Glow says AI coding agents are setting up deprecated Model Context Protocol (MCP) servers on developers' machines, a pattern it calls “MCPhantom”.

Glow Labs reviewed transcripts of real coding sessions. In 98% of the sessions where an agent set up a deprecated MCP server, Glow says, the agent appears to have chosen the package because it was in the model's training data; in the other 2%, the user asked for it by name. Glow does not say how many sessions it reviewed.

The servers are Anthropic's old reference servers, archived in May 2025. Glow counts 17,352,267 npm downloads of them since 10 July 2025, and reports four high-severity flaws in them, including a remote-code-execution bug in the Puppeteer server. It saw the pattern in Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat.

The maintainers closed Glow's report as out of scope. The repository “is unmaintained, so no fix or release will come from this repository”, Glow quotes them as saying. Help Net Security reports that no exploitation has been seen yet.

“The model's memory is now a package manager with no deprecation feed,” said Ophir Arie, Glow's co-founder.

• Claimed In 98% of the sessions Glow found where an agent set up a deprecated MCP server, the choice appears to have come from training data. Glow Labs, MCPhantom
• Claimed The archived servers have had 17,352,267 npm downloads since 10 July 2025 and carry four high-severity flaws, Glow says. Glow Labs, MCPhantom
• Reported No exploitation has been seen yet, Help Net Security reports. Help Net Security