Security firm Glow says AI coding agents are installing deprecated, unpatched MCP servers chosen from their training data, including one with a code-execution flaw

What happened

Security firm Glow says AI coding agents are installing deprecated, unpatched MCP servers (add-on tools connecting an agent to services such as GitHub) on developer machines. In session transcripts from Claude Code, Cursor, Codex CLI and other tools, the agent took the package name from its training data in 98% of the sessions where a deprecated server was set up; in the rest the user named it. In one session the agent saw npm's deprecation warning, installed the package anyway and told no one. Glow says four high-severity flaws sit in the archived servers, and the maintainers closed its report because no fix will come. Glow has not seen exploitation, and does not say how many sessions it reviewed.

Why it was a problem

The developers asked for a capability, such as a GitHub connection, not for a specific abandoned package, yet the agent chose and ran code from a public registry on machines that hold company credentials. Glow says the worst flaw, in the Puppeteer server, lets a prompt injection start any process, and the developer's web-browsing permission covers it. With no fix and no vulnerability identifier, scanners stay quiet. The evidence is one vendor's analysis, with no attack observed.

How SAG could have helped

Under the assumptions below, the agent's tool setup would be a work class, a defined piece of work with declared steps, and installing a tool server would be a declared step with a named operation and target. The grant for that work, made by a person, would list the exact server packages that person has approved, such as each service owner's own server. When the agent chose an archived package from its training data, the install request would name a target outside the grant's scope and would be refused before it was dispatched. Permission attaches to the exact operation and target a person granted, so neither the user's general request nor the agent's memory of a package name creates it. Installing code that runs on a developer machine is hard to reverse, so the grant can set that step's gate, the required human involvement, to a decision by a named person on each new package, and the install would wait for it whatever warning the agent ignored. SAG does not check whether a package is deprecated or flawed, detect prompt injection or patch the abandoned servers. What an approved server does inside itself is governed only where its actions pass through the same control point.

Assumptions we must make

• The organization defines agent tool setup as declared steps and lists the exact MCP server packages a person has approved, after checking each one's deprecation status. (Assumed)
• Every coding agent, including tools developers install themselves, runs package installs and server launches only through the governed path, with no npx route around it. (Unknown)
• A named person is available to decide each request to install a package not on the approved list, and the organization treats installing code on a developer machine as a decision-level step. (Assumed)

Classification

Category

Disclosed vulnerability

Section

Agent governance

Is update

No

Rank

1

Event date text

Observed in session transcripts before 2026-11-02; flaws reported to the maintainers 2026-10-04 to 2026-10-11

Publication date text

2026-11-02 (Glow); 2026-11-03 (Help Net Security)

Governance analysis

Intended task

Set up an MCP server so the coding agent can reach a service such as GitHub or a browser.

Action taken or attempted

The agent selected a deprecated, archived MCP server package from its training data and installed it through npx, in one session after npm reported it deprecated.

Access

The developer's machine and its credentials, the npm registry, and the ability to run arbitrary packages and start processes.

Authority boundary

A general request to set up a service connection, versus the choice of a specific unmaintained third-party package that then runs on the machine.

Harm or near miss

Deprecated servers with four unpatched high-severity flaws are running on developer machines. Glow has not seen exploitation and says none of the reviewed sessions involved a malicious actor.

Control failure

The harness did not warn on or refuse a deprecated package, the model's knowledge has no deprecation signal, and a web-browsing permission covers the vulnerable server's commands, per Glow.

Control categories

Scope of authority, Human approval

Diagnosis confidence

Supported inference

Preventive or detective control

An approved list of MCP servers with one per service, deprecation status checked before approval, and a refusal or warning in the harness for deprecated packages.

Approval path

Not established

Authority comparison

The agent could pick and run any package from the public npm registry on the developer's machine; a new engineer installs tools only from a vetted list.

Timeline

• Reference repository archived: 2025-05
• Deprecated packages download count start: 2025-07-10
• Glow report closed out of scope via hackerone: 2026-07-30
• Flaws reported to anthropic cna: 2026-10-04 to 2026-10-11
• Maintainers close advisory no fix: 2026-10
• Glow publishes research: 2026-11-02
• Help net security coverage: 2026-11-03

Sources

• glow.io
• helpnetsecurity.com

Notes

From sources

• Glow reviewed real coding-session transcripts and found deprecated Anthropic reference MCP servers installed on endpoints (Glow; Help Net Security).
• In 98% of those sessions the agent chose the name from training data; in the other 2% the user asked for it (Glow).
• In one session the agent received npm's deprecation message and installed the package anyway without telling the user (Help Net Security, quoting Glow).
• Glow reports four high-severity flaws in the archived servers; the maintainers said no fix will come (Glow).
• Glow has not seen exploitation and says none of the sessions involved a malicious actor (Glow).

Inferred

• A narrower, person-approved install list would have refused the archived packages (supported inference from the install being a discrete step).

Not established

• How many sessions Glow reviewed in total.
• Which of the four flaws other than the Puppeteer server could be reached from a typical configuration.
• Whether any organization has been attacked through these servers.
• How many of the observed installs were approved by the user at the time.

Disclaimers

• The SAG section is an architectural counterfactual under the stated assumptions. It is not a claim that Seampoint software operated in the reported environment.
• Reporting is based on public statements and press coverage. Sources may be incomplete, disputed or later corrected, and third-party allegations are unconfirmed unless the operator confirms them.
• SAG is described here by reference to Seampoint's work-class specification, which is an open review draft. It is not an adopted standard, and no production deployment has been qualified against it.