Events Secure.com at Black Hat USA 2026
Published: November 3, 2026 5 min read

AI Coding Assistants Are Installing Abandoned Connectors From Memory

AI coding agents install deprecated MCP servers from memory. Four serious flaws, no fix coming, and no trace of them in your software inventory.

By Secure.com
Summary

Suppose a developer on your team asks an AI coding assistant to connect to GitHub. The assistant picks a connector it remembers from the material it was trained on. Its owners stopped work on it in May 2025.

Nobody on your team chose it. Your software inventory does not list it.

What Happened?

Research published Monday says this is not a one-off. In 98% of the sessions it reviewed where an AI coding agent set up a deprecated MCP server, the package name appears to have come from the model’s training data rather than the developer. In the other 2%, the developer asked for the old package by name.

Four Serious Flaws, No Fix Coming

Researchers found four serious flaws in those abandoned connectors. Only one has been described publicly: a browser connector where hidden instructions on a web page could make the agent run a command of the attacker’s choosing. The report was closed as out of scope.

The repository is unmaintained, so no fix is coming. The archive notice says plainly that no security updates or bug fixes will be provided.

Millions of Downloads, Zero Patches

These are not obscure packages. Twelve of them have been pulled from npm more than 17.3 million times since July 2025. Five sit inside npm’s top 100 list of MCP servers.

What’s the Impact?

Why Your Controls Stay Quiet

Your existing controls are not built to catch this. Endpoint tooling sees a trusted developer process pulling a public package, which happens dozens of times a day. Dependency scanning has no project file to read, because the install happened outside your build. Inventory never registers it, because nobody filed a request.

Why the alert never fired

Three controls. One blind spot.

None of these tools failed. Each one looked at exactly what it was built to look at, and this software fell between them. The only place it shows up is the developer laptop.

Endpoint tooling
What it seesA trusted developer process pulling a public package. It does this dozens of times a day.
What it missesThat this particular package was abandoned and will never be patched.
Looks normal
Dependency scanning
What it seesYour repositories and your build. Everything declared in a project file.
What it missesAn install that happened outside the build, with no project file to read.
Nothing to scan
Software inventory
What it seesApplications that someone requested, reviewed and recorded.
What it missesSoftware a model chose on its own. No request was ever filed.
Never registered

Add the one check that closes it: list the connectors your developers’ AI assistants have installed, then approve one connector per service and replace the abandoned ones.

Source: Glow Labs, 2 November 2026 · Help Net Security, 3 November 2026

Older Than Your Security Policy

Nobody has been seen exploiting these flaws. No CVE identifiers have been assigned either, which is part of why scanners stay quiet. The real problem is quieter than a breach.

An AI assistant’s memory can be older than your security policy. A model trained a year ago will reach for software your team would reject today, and it will do it inside a workflow your developers already approved. This is shadow IT with a faster install path and no paperwork.

How to Avoid This

  • Search developer machines for configuration files pointing at deprecated connectors
  • Approve one connector per service, and write that choice down
  • Add deprecation status on npm to your approval criteria
  • Turn on the checks your assistant runs before it installs anything
  • Replace abandoned connectors with the ones the service owner maintains
Exposure check · Not a compromise list

The twelve names to search for

These are the deprecated connectors named in the research. Every one is marked on npm as no longer supported. Search your developer machines for configuration files that reference them, then replace each with the service owner’s own connector.

Read this firstNo indicators of compromise have been published for this story. No exploitation has been seen, and no CVE identifiers have been assigned. Treat the list below as an exposure checklist, not as evidence that anything has gone wrong.
npm scope to search for: @modelcontextprotocol/
server-github5,266,085
server-postgres4,312,874
server-slack3,198,630
server-puppeteer1,487,526
server-brave-search1,461,811
server-google-maps814,615
server-gitlab273,296
server-gdrive247,891
server-redis131,160
create-server122,534
server-aws-kb-retrieval23,028
server-everart12,817
17,352,267Downloads since July 2025
12Packages, all marked unsupported
0Fixes coming

Download figures: Glow Labs, 2 November 2026.
Deprecation status for all twelve packages confirmed against the npm registry on 3 November 2026.

Nobody Approved This Connector. That Is the Whole Problem.

The flaw here is not a package. It is that software entered your environment because a model remembered a name, and no person stood between the choice and the install. Secure.com is built on the opposite order: your team sets the rules, AI teammates do the work.

  • Scope every teammate to the repositories and pipelines you name, and nothing wider
  • Hold consequential actions behind a human yes, rather than letting a model act because it decided to
  • Keep an evidence trail, so the question of who approved this has an answer
  • Let the Red Teammate test what is actually exploitable in your environment before someone else does
  • Start with one teammate and prove the model works before you widen it

Research credit: Glow Labs.

Frequently Asked Questions

What is MCPhantom?
MCPhantom is the name Glow Labs gave to research, published on 2 November 2026, showing that AI coding agents install deprecated MCP servers on their own. In 98% of the sessions reviewed, the package name appears to have come from the model’s training data rather than from the developer.
What is a deprecated MCP server?
An MCP server is a connector that lets an AI assistant work with an outside service, such as a code host, a database or a chat tool. A deprecated one has been archived by its owners and receives no security updates or bug fixes. All twelve packages named in the research are marked on npm as no longer supported.
Have the flaws in these MCP servers been exploited?
No exploitation has been observed, and no CVE identifiers have been assigned. Researchers found four serious flaws, and only one, in the browser connector, has been described publicly. Because the repository is archived, no fix is coming for any of them.
Why do security tools miss deprecated MCP servers?
Endpoint tooling sees a trusted developer process pulling a public package. Dependency scanning has no project file to read, because the install happened outside the build. Software inventory never records it, because nobody filed a request.
How do I check whether my developers are exposed?
Search developer machines for configuration files that reference packages under the @modelcontextprotocol/ npm scope, such as server-github, server-postgres or server-slack. Replace any you find with the connector the service owner maintains, and approve one connector per service.

Other News