Some of the most dangerous Model Context Protocol servers still being installed are the ones nobody maintains. The Injection reports that Glow Labs, on November 2, 2026, described a pattern it calls MCPhantom: “AI coding agents pick deprecated Model Context Protocol servers out of their training data and install them.” The archived servers, Glow Labs says, “carry four high-severity flaws, including a prompt-injection RCE, and no fix is coming.”
Quick Take
- What: Agents recommend and install MCP servers that have been deprecated or archived, because those names still appear in training data and old tutorials.
- Risk: Four high-severity flaws on those servers, including a prompt-injection path to remote code execution. The original maintainers are not going to patch them.
- What to do: Inventory every MCP server your agents are allowed to install. Block archived and deprecated packages by name, and require an allowlist of maintained servers with pinned versions.
What happened
MCP servers are small local programs that give an agent tools: file access, browser control, a database, a shell. Developers already struggle to vet the ones they choose on purpose. Glow Labs’ finding is that the agent will sometimes choose for them, and it will choose poorly — pulling a server that looks familiar because it was popular when the model was trained, even though the project has been abandoned with known bugs still open.
A prompt-injection RCE on an MCP server is particularly ugly: untrusted content the agent reads can become code execution on the developer’s machine, through a component the developer may not even remember installing.
What you should do
- Audit installed MCP servers in Cursor, Claude Desktop, Copilot, Claude Code, Gemini CLI and any other agent host you use. Remove anything deprecated, archived, or unpinned.
- Put an allowlist in place. Do not let an agent install a new MCP server without a human review, and pin versions.
- Search internal docs and agent skills (for example
AGENTS.mdor tool catalogs) for old server names and delete those recommendations. - There is no vendor patch coming for the archived projects themselves. Replacement with a maintained server, or removal, is the fix.
What it means
Training data has a long tail. A protocol like MCP, which lets a model reach out of the chat window, inherits that tail as a live attack surface. MCPhantom is less a single CVE and more a supply-chain hygiene failure: the agent is a package manager with bad memory. Security teams that already inventory npm and PyPI now need an inventory of MCP servers too.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This i10x report is based on The Injection’s week-45 summary of Glow Labs’ November 2, 2026 MCPhantom report. i10x did not independently enumerate the four flaws or the deprecated package names.
