AI coding agents install archived MCP servers with no patches

Glow Labs studied sessions of AI coding in use. It found that agents install archived MCP servers, which are add-on tools that an agent connects to. The pattern has the name MCPhantom. 4 high-severity vulnerabilities are in these servers, and the owners will not make a patch. Glow Labs saw no attack at this time.

How it works

A developer tells an agent to install a GitHub MCP server. The agent selects a package from the memory of its model. It installed an archived server of Anthropic. GitHub has a server, but the agent did not select it.

The numbers

• Users downloaded the archived packages more than 17.3 million times since July 2025.
• 5 of them are in the npm list of the 100 top MCP packages.
• One vulnerability lets an attacker operate commands through text that gives the agent commands.

What is not known

The maintainers closed the report as out of scope and said the server is archived. Glow Labs says usual tools do not see the servers, because they have no dependency list. Glow Labs found no package that npm removed for a vulnerability.

Insight: Four parties can fix this and each one waits

BeyondTrust says 85% of the coding agent users it saw had an MCP server. Glow Labs says a repair by the makers of agent tools works only if all of them do it. No maker starts first, and the one repair that works at this time is a control that operates before each step. Leaders must select one person for this control.