AI coding agents keep installing archived MCP servers that will never get security fixes

Update, November 5, 2026: The npm registry now shows all twelve archived packages named below, including the Puppeteer server, as deprecated with the message "Archived and unmaintained; no security guarantees." The registry records for server-puppeteer, server-github and server-postgres were last changed early on November 5. A deprecation notice is a warning, not a block: the packages can still be installed, and no fix has been released.

AI coding assistants such as Claude Code, Cursor and Codex CLI are still setting up old "reference" MCP servers that were archived in May 2025 and will never receive security fixes, according to research Glow Labs published on November 2, 2026. One of them, the Puppeteer browser server, has a high-severity flaw that lets a prompt injection turn "browse the web" into "run any command". If your developers use AI agents, check their MCP configurations for @modelcontextprotocol/server-* packages and replace them with maintained servers.

What happened, in plain English

MCP (Model Context Protocol) is a standard way to give an AI assistant tools: a small program called an "MCP server" lets the assistant read GitHub issues, query a database, post in Slack or drive a web browser. In late 2024 the MCP project published a set of example servers for popular services. In May 2025 most of them were moved to an archive repository with a plain warning: no longer maintained, no security updates, no guarantees.

The problem is that AI models learned about these servers during training, when they were the standard choice. When a developer says "connect yourself to GitHub", the agent often reaches for the package name it remembers, not the one the service owner maintains today. Glow Labs, the research team at security company Glow, says that in 98% of the sessions it reviewed where an agent set up a deprecated server, the agent picked the name itself; in only 2% did the user ask for it.

Think of it as a contractor who learned the trade from an old catalogue and keeps installing a model of smoke detector that was recalled years ago, without telling you.

The archived packages have been downloaded from npm (the main JavaScript package registry) more than 17.3 million times since July 10, 2025. Glow found four high-severity bugs in them. The maintainers have said the code is unmaintained and no fix will come. Glow says it has not seen these flaws exploited.

Are you affected? What to do now

Who is affected: anyone who uses an AI coding agent or desktop AI assistant with MCP servers, especially on developer laptops. Glow saw the behavior in Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, with models from Anthropic, OpenAI and xAI. The risk sits in the configuration on each machine, not in a cloud service you can patch centrally. If nobody in your organization uses MCP servers, you have nothing to do.

Packages Glow names as archived: server-github, server-postgres, server-slack, server-puppeteer, server-brave-search, server-google-maps, server-gitlab, server-gdrive, server-redis, create-server, server-aws-kb-retrieval and server-everart, all under the @modelcontextprotocol npm scope. The archive repository also lists Git, Sentry and SQLite servers.

Checklist:

• Find MCP configurations. Look in each AI tool's MCP settings and config files on developer machines and in project repositories (for example per-project .mcp.json files, Cursor's mcp.json, Claude Desktop's config file, Codex CLI's config). Search them for @modelcontextprotocol/server-.
• Do not rely on your usual scanners. Glow notes these servers usually run through npx (which downloads and runs a package on the fly), so they don't appear in dependency files, software inventories or software composition analysis (SCA) reports, and endpoint detection sees only a normal Node.js process.
• Replace, don't just update. There is no patched version. Switch to the service owner's own MCP server where one exists (for example GitHub's official server instead of server-github), or to a server from the maintained modelcontextprotocol/servers repository.
• Prioritize the Puppeteer server. It carries the remote code execution flaw Glow describes. Remove it first, and treat any machine where it browsed untrusted sites as worth a closer look.
• Set a rule for the future. Approve one MCP server per service, check npm deprecation status before approving, and tell developers to review what an agent proposes to install. Glow observed one agent see the npm deprecation notice and install the package anyway without telling the user.
• Rotate tokens if in doubt. Old GitHub, Slack, GitLab or database servers were given access tokens. If you remove one you can't vouch for, rotating its token is a cheap precaution.

The expert view

The root cause is not a single bug but a broken update path. Traditional package security assumes a feedback loop: a component is deprecated, scanners flag it, the dependency is upgraded. MCPhantom shows that loop does not reach a new kind of installer: the model itself. As Glow's Ophir Arie puts it, "The model's memory is now a package manager with no deprecation feed." Model knowledge is frozen at training time, and retraining to forget old package names is slow and expensive.

The Puppeteer issue illustrates why this matters. Glow describes a flaw where content that hijacks the agent through prompt injection (instructions hidden in a web page or document the agent reads) can make the server launch an arbitrary process instead of a browser. The developer approved "let the agent browse", but that permission in effect covers running commands on the machine. This is the classic gap in agent security: approvals are granted at the level of a tool, while the tool's real reach is wider. We describe the mechanism only at this level; Glow has not published full details of the other three flaws.

Several controls fail at once. SCA sees no manifest. EDR (endpoint detection and response) sees a trusted runtime fetching a public package. npm's deprecation flag is a warning, not a block, and npm lets owners remove widely used packages only under narrow conditions. The disclosure path also stalled: Glow reported through HackerOne on July 30, 2026, was told it was out of scope, then reported all four flaws to Anthropic's CVE numbering authority between October 4 and 11. According to Glow, the Puppeteer server's maintainers closed the report because the repository is archived and said they would look at marking the npm package deprecated. As of November 5, the flaws have no CVE IDs.

Severity in context: no CVSS scores exist, and there is no known exploitation, so this is not an emergency patch cycle. But it is likely underrated by conventional tooling precisely because it is invisible to it. The download numbers (over 5.2 million for server-github alone since July 2025, per Glow) suggest a large installed base, although downloads are not unique users and many may come from automated runs.

It fits a pattern we have covered repeatedly this autumn: the developer workstation, with its agent, its MCP servers and its tokens, has become a supply-chain endpoint that inventory and patch processes don't yet see. What remains unknown: the exact number of affected installations, details of the other three flaws, and whether agent vendors will add deprecation checks. Glow suggests harness makers refuse or warn on deprecated servers and that security teams use the pre-execution hooks many harnesses already support.

Official sources

• MCPhantom: AI coding agents are installing vulnerable, deprecated MCP servers from training data. Glow Labs, November 2, 2026
• Archived reference servers repository. Model Context Protocol (archived May 29, 2025; "no security guarantees")
• Maintained servers repository. Model Context Protocol
• @modelcontextprotocol/server-puppeteer on npm (deprecation status checked November 5, 2026)

Coverage: Help Net Security, "AI coding agents are installing MCP servers that will never be patched" (November 3, 2026).