A request to connect a service can delegate dependency selection as well as configuration. In Glow Labs' MCPhantom investigation, coding-agent sessions selected retired MCP reference packages and introduced them into executable tool environments despite upstream archival and missing maintenance. The observed artifacts support package selection and…
Inspect the ClaimsCase · DiggingBeagle record
MCPhantom: coding agents installed archived MCP servers
Glow Labs documented agents selecting and installing retired MCP reference packages. The observed installation path is separate from its inference about training-data familiarity and from any later exploitation.
Public disclosure: Nov 5, 2026
Scope
Research reported in a controlled research or disclosure setting. Exact prerequisites, versions and absence of documented exploitation must be preserved.
Assessment profile
Assessment method- Setting
- controlled live
- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Glow Labs reports observed agent selections and installations of deprecated MCP servers. Those installations are observed, but exploitation of the installed servers or compromise of a downstream environment is not established by the cited source. No impact band is assigned.
Assessed Nov 9, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-MCPHANTOM-OBSERVED-INSTALLS · CLM-MCPHANTOM-TRAINING-INFERENCE · Glow Labs MCPhantom deprecated MCP server installation study
At a glance
Agent-selected dependencies can silently reintroduce archived tool servers with broad local privileges, independent of whether the initial user knew the package name.
Read the implicationsThe 98% training explanation is an attribution by the vendor and has no independent population denominator; no observed exploitation of installed endpoints or measured compromise count is established.
Limits and uncertaintyFull account
A request to connect a service can delegate dependency selection as well as configuration. In Glow Labs' MCPhantom investigation, coding-agent sessions selected retired MCP reference packages and introduced them into executable tool environments despite upstream archival and missing maintenance.
The observed artifacts support package selection and installation. Glow's explanation that 98% of the choices came from model training familiarity is a vendor attribution, not a causal measurement visible in the action trace or an independently established population rate. The source does not establish exploitation of the installed endpoints or a count of compromised developers.
Three outcomes to keep separate
Choosing an obsolete dependency, running it and having an attacker exploit it are different events. The first two can enlarge an agent's effective authority because an MCP process may inherit local or cloud credentials, but that possible exposure must not be reported as confirmed theft.
A useful admission review checks the maintained upstream, archival status, advisories and exact version before an assistant adds executable capabilities. That is a control recommendation, not a prevention rate measured by this investigation. An official-looking package namespace does not establish continued maintenance. The page displays inconsistent November 2 and November 5 dates; its exact initial publication date remains unresolved here.
Mechanism and trust boundary
- 01
A user asks a coding agent to connect a service, such as GitHub, without selecting an exact MCP package.
- 02
The agent names an older reference package from model recollection instead of checking its current upstream status.
- 03
The package is installed or written to MCP configuration despite an upstream archive warning and absent fixes.
Claims & evidence
CLM-MCPHANTOM-OBSERVED-INSTALLSGlow Labs reports actual agent session transcripts and endpoint inventories showing agents selected and installed deprecated MCP reference servers even without a user specifying that version.supported
Basis: reported finding
- supportsGlow Labs MCPhantom deprecated MCP server installation studyprimary disclosure
What did Glow Labs find?; Developer request to deprecated install sequence
CLM-MCPHANTOM-TRAINING-INFERENCEGlow Labs attributes 98% of its observed deprecated-server selections to apparent model training-data familiarity, but its disclosure does not provide a reproducible denominator or causal proof of what was in each model's training corpus.supported
Basis: reported finding
- supportsGlow Labs MCPhantom deprecated MCP server installation studyprimary disclosure
Intro: 98% explanatory claim and Why do agents keep choosing deprecated servers?
Implications
Agent-selected dependencies can silently reintroduce archived tool servers with broad local privileges, independent of whether the initial user knew the package name.
Controls and mitigations
- Pin verified maintained MCP packages, require explicit human approval for executable dependency installs, and compare chosen names to upstream archive and advisory status.
Unknowns and contradictions
- The 98% training explanation is an attribution by the vendor and has no independent population denominator; no observed exploitation of installed endpoints or measured compromise count is established.
Sources and citation
Material revision history
- Nov 9, 2026 · Published version · first publication · revision 233