What happened
In its November 3, 2026 post, Glow Labs describes reviewing real-world AI coding session transcripts and finding agents setting up deprecated local Anthropic MCP servers on developer endpoints. The cases spanned Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, and models from Anthropic, OpenAI and xAI. Glow calls the pattern “MCPhantom”: retired MCP servers continue to appear on developer machines because agents reproduce package names learned from earlier material.
The source says that in 98% of sessions where an agent set up a deprecated server, Glow believed the selection came from the model’s training data. A developer might ask for a capability such as a GitHub MCP server; the agent then supplies an old reference-server package rather than the current server maintained by the service owner. In the other 2% of cases, the user explicitly requested the deprecated package. The agent can write the MCP configuration itself or give the developer an install command, after which npm or npx installs the package. The source gives the GitHub example: an archived Anthropic server was chosen instead of the server maintained by GitHub.
Glow says 13 of Anthropic’s original 20 reference servers, released when MCP was introduced in 2024, were later archived as service providers published their own integrations. The archived repositories say that they will receive no security updates or bug fixes. Across the original deprecated servers, Glow found four high-severity vulnerabilities. The most serious is a remote code execution flaw in the Puppeteer server: a prompt injection can cause an agent to start an arbitrary process on the machine instead of opening a browser session. Glow reports the issue; maintainers said the repository was unmaintained, that no fix or release would come from it, and closed the report as out of scope.
The post reports 17,352,267 npm downloads across the listed packages since July 10, 2025, including 5,266,085 for server-github and 1,487,526 for server-puppeteer. Glow says npx can still install deprecated packages, with only a warning. It argues that conventional controls can miss this activity: an npx-launched server may not appear in a project manifest or installed-application inventory, while a trusted Node process and absent CVE can leave EDR and software composition analysis quiet. The endpoint where the agent writes configuration and runs installation is therefore central to detection. Glow’s recommended response is to find and replace deprecated servers, inspect MCP configurations on developer machines, and use supported alternatives.
What the archive adds
This is a new security finding connected to earlier coverage of MCP integrations, not a restatement of the same event. Ghidra MCP: Ghidra MCP Server examined an MCP server exposing reverse-engineering capabilities to agents; Mitigant’s MCP server for guarded cloud attack emulations covered a newer, purpose-built integration. MCPhantom adds the operational risk that agents may select abandoned integrations from learned package names.
Trend signal
The finding supports agent security moves to runtime boundaries. A prompt or harness permission is not enough to establish that an agent’s chosen executable is trustworthy: the package it installs and the endpoint where it runs matter. Glow’s account also reinforces the practical significance of agent protocols becoming an interoperability layer, while showing that a broadly reusable integration layer inherits lifecycle and maintenance risks.
Why now
Glow links the pattern to ecosystem turnover: Anthropic’s reference servers served as examples when MCP launched, but many were archived after service owners released their own servers. Model training data may preserve the earlier package names, while the ecosystem continues changing. The post notes that deprecation on npm does not prevent npx installation, leaving a gap between an old package’s status and what an agent can still run.
Why it matters
For teams, an agent’s package recommendation should be treated as a suggestion, not as a dependency-resolution mechanism. A familiar name can refer to an abandoned implementation, and an install launched outside a project’s manifest may escape controls built around repository dependencies. That makes MCP configuration an endpoint asset to inventory and govern, alongside code and conventional packages.
The most useful immediate response is procedural: define approved server identities, check configurations and local processes for archived packages, and replace them with maintained service-owner integrations where available. The finding does not show that every agent will make this choice or that exploitation has occurred. It does show that model recall can preserve obsolete software choices at scale, so security review needs to verify both provenance and maintenance status before an agent installs a tool.
Limits and uncertainty
The post reports Glow Labs’ transcript review and vulnerability findings; the supplied material does not state the total number of sessions reviewed or establish a population-wide rate for agent behavior. The 98% figure applies to the sessions in which an agent set up a deprecated server, not to all coding-agent sessions. Glow says it has not seen exploitation of the vulnerabilities. The source also does not establish that all listed downloads represent active installations, nor that every usual EDR or SCA product will miss every instance. It describes a plausible attack path and a detection gap, not confirmed compromises.
Skill to build now
This week, inventory MCP configuration files on developer machines and search for archived @modelcontextprotocol server references, especially those launched with npx. For each match, verify the current package against the service owner’s maintained integration, then replace it and record the approved package identity in your team’s setup guidance. This directly addresses the selection and visibility problems Glow describes.
Reader takeaway
An agent can revive an obsolete integration because its package name is familiar from training data. Verify the package and its maintenance status before installation, and include local MCP configurations in endpoint inventory: a server launched by npx may not appear in the places teams normally inspect.