What happened
Glow Labs documented sessions (across Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, using Anthropic/OpenAI/xAI models) where an AI coding agent asked to 'set up a GitHub MCP' installed a deprecated, archived reference MCP server instead of the current service-owner server. In 98% of sessions the agent appeared to fill in the old package name from the model's training data. Four high-severity flaws were found in those reference servers, the most serious being a remote-code-execution bug in the Puppeteer server that a prompt injection can trigger (the agent runs an arbitrary command instead of the browser under the already-granted browsing permission). The maintainers closed the report out of scope because the repo was archived in May 2025 and unmaintained; no patch will come, but the packages still install via npx. The deprecated @modelcontextprotocol/* packages have been downloaded more than 17.3 million times since July 2025, five of them in npm's top MCP 100. No exploitation has been seen yet.
Why it matters
This is an invisible supply-chain gap: these MCP servers never appear in a dependency manifest, run through npx, and have no CVEs, so SCA, EDR and software inventory all stay quiet while an unpatched prompt-injection-reachable RCE lands on a developer's machine. It turns a model's 'memory' into an unmaintained package manager with no deprecation feed, so a hostile repo or prompt-injection can cause an AI coding agent to install and operate a vulnerable archived server on a developer's machine.
Attack vector
A coding agent recommends/installs a deprecated archived MCP server it recalls from training data; an unmaintained server carries a prompt-injection-reachable RCE (Puppeteer browser driver), so a hostile web page or prompt injection can make the agent run arbitrary commands under the already-granted browser/exec permission.
Affected systems
AI coding agents (Claude Code, Cursor, Codex CLI, Claude Cowork) + deprecated @modelcontextprotocol/* reference MCP servers; four high-severity flaws incl. prompt-injection RCE in the Puppeteer server.
Mitigation
Add npm deprecation status to MCP install-approval criteria; restrict agent installs to an approved server registry; use pre-execution hooks to inspect newly installed servers; switch to the service owner's current server where available; treat agent package selection as untrusted and require operator approval.