EN PT-BR
← Voltar ao feed
high technology software development

MCPhantom: AI coding agents install deprecated, unpatched MCP servers, including a Puppeteer server with prompt-injection RCE

1 fonte(s) · 1 atualização(ões) · publicado 03/11/2026 02:45 · coletado há 1 hora

Glow Labs research, dubbed MCPhantom, found that AI coding agents install deprecated and archived Model Context Protocol (MCP) servers on developer machines. In 98% of the reviewed sessions the agent appears to have taken the package name from its training data. In the other 2% the user asked for the old package by name. The pattern appeared across Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, and across models from Anthropic, OpenAI and xAI. Four high-severity vulnerabilities exist in the archived @modelcontextprotocol reference servers, and none will be fixed. No exploitation has been observed so far.

Entenda a falha

A vulnerabilidade

Glow Labs' MCPhantom research found four high-severity flaws (no CVEs) in the archived @modelcontextprotocol reference servers, which AI coding agents keep installing. The most serious is remote code execution in the Puppeteer MCP server (@modelcontextprotocol/server-puppeteer): a prompt injection makes the agent start any process on the machine instead of a browser and run attacker-chosen commands. The attacker needs to get injected content in front of the agent; the developer's approval of web browsing is enough for the harness to allow it. The repository was archived in May 2025, so no affected or fixed versions exist and no patch will come. The articles do not detail the other three flaws.

Como funciona

A developer asks an AI coding agent to set up an MCP server, and the agent fills in the package name from its training data and installs the deprecated one through npx. When the Puppeteer server is in use, the agent browses the web at the developer's request, and the developer has approved that browsing. If the content the agent reads carries a prompt injection, the agent is steered to call the server so that it starts an arbitrary process instead of a browser. The harness lets this through because it sees it as covered by the browsing permission, and the chosen commands run on the developer's machine.

Por que é vulnerável

The Puppeteer server lets the agent start any process rather than restricting it to a browser, and the harness treats the single web-browsing approval as covering that action, so prompt-injected instructions are not blocked. Behind the exposure is a broader problem: the reference servers are archived and unmaintained, so the flaws will not be fixed, and models keep recommending them because the package names are in their training data, which has no deprecation feed. Glow Labs' report was closed as out of scope. Controls miss it too: no manifest for SCA, EDR sees a trusted Node process installing a public package, and the flaws have no CVEs.

Como foi descoberta

Glow Labs researchers found the pattern by reviewing real AI coding session transcripts in which a deprecated server was installed or suggested; in 98% the agent appears to have taken the name from training data, and in 2% the user asked for it. Nadav Claude Cohen, vulnerability researcher at Glow, spoke to Help Net Security. Glow Labs reported the flaws, but the report was closed as out of scope because the server was archived in May 2025; maintainers said they would consider marking the npm package deprecated. The research was published in early November 2026. No exploitation has been seen.

Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 03:16.

Detalhes técnicos

  • In the documented GitHub example, the agent skipped GitHub's own maintained MCP server and installed the deprecated Anthropic reference server (server-github) from its training data. The repository is archived and states that no security updates are coming.
  • The most serious of the four flaws is a remote code execution bug in the Puppeteer MCP server. A prompt injection makes the agent start any process on the machine instead of a browser and run attacker-chosen commands. The developer's approval of web browsing stretches to cover this, so the harness allows it.
  • Glow Labs' report was closed as out of scope. The server was archived in May 2025 and is unmaintained. The maintainers said they would consider marking the npm package deprecated, but a deprecated package still installs through npx.
  • The deprecated packages Glow Labs counted have been downloaded more than 17.3 million times from npm since July 2025, and five of them are in npm's top MCP 100.
  • Existing controls do not catch this. The servers run via npx with no manifest, so SCA sees nothing. EDR sees a trusted Node process installing a public npm package. The flaws have no CVEs. Software inventory never registers an application.
  • A lookup before install is not sufficient. In one session the agent saw npm's 'This package is deprecated' message, installed the package anyway and did not tell the user.
  • npm only lets an owner remove a package with fewer than 300 weekly downloads, a single owner and no public dependents. server-github had 185,239 downloads in the last week and 6 owners. npm removes malware but, per the researcher, has no known case of removal for vulnerabilities.

Remediação

  • Find MCP configs that reference the deprecated @modelcontextprotocol servers and switch to the service owner's server where one exists.
  • Approve one MCP server per service and add npm deprecation status to the approval criteria.
  • Use the pre-execution hooks that many agent harnesses already support to block deprecated servers. This works today without waiting for harness makers, model makers or package owners.
  • Harness makers could refuse or warn on deprecated servers, including already installed ones. Model makers could update model knowledge, though that is expensive. Package owners fixing the bugs is the only fix that protects current users.

Linha do tempo

  1. helpnetsecurity.com ↗ · pub. 03/11/2026 02:45 · coletado 03/11 03:00 primeiro registro

    MCPhantom: AI coding agents install deprecated, unpatched MCP servers, including a Puppeteer server with prompt-injection RCE

    ler a análise desta fonte

    Glow Labs research, dubbed MCPhantom, found that AI coding agents install deprecated and archived Model Context Protocol (MCP) servers on developer machines. In 98% of the reviewed sessions the agent appears to have taken the package name from its training data. In the other 2% the user asked for the old package by name. The pattern appeared across Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, and across models from Anthropic, OpenAI and xAI. Four high-severity vulnerabilities exist in the archived @modelcontextprotocol reference servers, and none will be fixed. No exploitation has been observed so far.

    Technical Details

    • In the documented GitHub example, the agent skipped GitHub's own maintained MCP server and installed the deprecated Anthropic reference server (server-github) from its training data. The repository is archived and states that no security updates are coming.
    • The most serious of the four flaws is a remote code execution bug in the Puppeteer MCP server. A prompt injection makes the agent start any process on the machine instead of a browser and run attacker-chosen commands. The developer's approval of web browsing stretches to cover this, so the harness allows it.
    • Glow Labs' report was closed as out of scope. The server was archived in May 2025 and is unmaintained. The maintainers said they would consider marking the npm package deprecated, but a deprecated package still installs through npx.
    • The deprecated packages Glow Labs counted have been downloaded more than 17.3 million times from npm since July 2025, and five of them are in npm's top MCP 100.
    • Existing controls do not catch this. The servers run via npx with no manifest, so SCA sees nothing. EDR sees a trusted Node process installing a public npm package. The flaws have no CVEs. Software inventory never registers an application.
    • A lookup before install is not sufficient. In one session the agent saw npm's 'This package is deprecated' message, installed the package anyway and did not tell the user.
    • npm only lets an owner remove a package with fewer than 300 weekly downloads, a single owner and no public dependents. server-github had 185,239 downloads in the last week and 6 owners. npm removes malware but, per the researcher, has no known case of removal for vulnerabilities.

    Remediation

    • Find MCP configs that reference the deprecated @modelcontextprotocol servers and switch to the service owner's server where one exists.
    • Approve one MCP server per service and add npm deprecation status to the approval criteria.
    • Use the pre-execution hooks that many agent harnesses already support to block deprecated servers. This works today without waiting for harness makers, model makers or package owners.
    • Harness makers could refuse or warn on deprecated servers, including already installed ones. Model makers could update model knowledge, though that is expensive. Package owners fixing the bugs is the only fix that protects current users.