MCP Security in 2026: What the New Specification Fixed and What It Opened Up
8 min readThe MCP 2026-07-28 specification removes session and OAuth risks but adds new attack surfaces, according to Akamai researchers. What changed and what to do about it.
Zunkiree Labs Team
· Updated
In short: The Model Context Protocol (MCP), the standard that lets AI agents call tools and data sources, shipped a major revision dated 2026-07-28. Akamai researchers, writing in June 2026 about the release candidate, found it removes several long-standing risks, such as protocol sessions and weak OAuth grants, while handing developers new ones to manage, including client-held state, unsigned metadata and header mismatches. The practical lesson is that a safer protocol does not make a deployment safe: much of the responsibility moved to whoever builds and runs the server.
Key Takeaways
- MCP 2026-07-28 is described by SiliconANGLE, reporting on Akamai's research, as the biggest architectural change to the protocol since Anthropic created it. It includes a 12-month deprecation window for some legacy features.
- It removes protocol-managed sessions that used the
Mcp-Session-Idheader, which could let an attacker impersonate a user if the ID was stolen. - It limits unsolicited server-initiated prompts, and replaces legacy password and implicit OAuth grants with mandatory OAuth 2.1 with PKCE.
- Akamai identified six new attack surfaces, from client-held state to abuse of long-running tasks.
- The common thread is that checks the protocol used to perform now fall to implementers. Treat anything the client sends as untrusted.
- If you run MCP servers, review them against the new specification instead of assuming an upgrade makes them safe.
What MCP Is, in One Paragraph
MCP is an open protocol for connecting AI agents to external tools and data: a calendar, a database, a code repository, a company's internal search. An agent speaks to an MCP server, which exposes a defined set of actions. Because one protocol serves many tools, businesses can switch models or add tools without rebuilding each connection. We covered why that matters in why AI agents are getting their own infrastructure.
What the New Specification Removed
According to SiliconANGLE's report on the Akamai analysis, the revision removes three older risks:
- Protocol-managed sessions. Earlier versions tracked sessions with an
Mcp-Session-Idheader. If an attacker obtained the ID, they could impersonate the user. The new specification drops protocol sessions. - Unsolicited server prompts. Servers could previously push prompts to the client. These are now strictly limited.
- Weak OAuth grants. Legacy password and implicit grants are replaced by mandatory OAuth 2.1 with PKCE, a stronger authorisation flow.
What It Opened Up
Removing server-side sessions moves state to the client. Akamai's researchers, Maxim Zavodchik, Segev Fogel and Gal Meiri, listed six areas to watch:
| Area | The risk, in plain terms |
|---|---|
| Client-held state | The client returns state objects and IDs. Predictable IDs or unvalidated objects could let an attacker hijack a workflow or act across tenants. The specification says to verify them but not how. |
Unsigned _meta objects |
Metadata can be attached to most messages without a signature, so a forged field such as a fake admin tenant could escalate privileges. |
| Header and body mismatch | The Mcp-Method and Mcp-Name headers can disagree with the message body, letting requests slip past proxies and monitoring. |
x-mcp-header mapping |
Mapping the wrong argument could place API keys, tokens or personal data in headers that proxies, load balancers and logs can see. |
| MCP Apps | Interactive panels can carry stored cross-site scripting. Sandboxing limits full takeover, but a compromised panel could still show deceptive content or capture visible data. |
| "Hit-and-run" tasks | An attacker can start an expensive long-running task and disconnect, leaving the server to bear the cost. |
The article contains no statistics. These are researchers' analysis of a specification, not reports of attacks seen in the wild.
What to Do If You Run MCP Servers
Akamai's recommendations map to a short checklist:
- Treat client-supplied state and metadata as untrusted. Verify it cryptographically and do not trust a field because it looks internal.
- Check that headers match the body before acting on a request.
- Review what ends up in headers and logs, and keep secrets out of them.
- Encode and sandbox anything an agent renders as an interactive panel.
- Set resource quotas on asynchronous tasks so abandoned jobs cannot run up costs.
- Keep an inventory of servers. You cannot secure a server nobody knows about. See our companion post on the OWASP MCP Top 10.
What This Means for Businesses Buying Agents
You do not need to read the specification, but you should ask your supplier three questions: which MCP version their servers run, how they verify client-supplied state, and what is logged when an agent calls a tool. An answer that depends on "the protocol handles that" is out of date.
For how to bound an agent's authority, see our whitepaper on AI agents for business and our AI governance checklist, or talk to us about custom AI agent development.
The Short Version
The MCP revision closes real gaps, but it shifts work onto the people who build servers. Verify client-supplied state, check headers against the body, keep secrets out of logs, sandbox rendered panels and cap long-running tasks. Treat the researchers' findings as a checklist, not as proof of attacks in the wild.
Frequently asked questions
What is MCP 2026-07-28?
It is a major revision of the Model Context Protocol, scheduled for final release on 28 July 2026 after a May release candidate. SiliconANGLE describes it as the biggest architectural change since Anthropic created the protocol.
Is the new MCP specification more secure?
It removes some older risks, including protocol sessions and weak OAuth grants. Akamai also found new attack surfaces, because responsibility for state and verification moved to implementers.
Does this affect my business if I do not build MCP servers?
Indirectly. If your suppliers or tools use MCP, ask how they handle the points above.
Who found these risks?
Researchers Maxim Zavodchik, Segev Fogel and Gal Meiri at Akamai, as reported by SiliconANGLE on 25 June 2026.
Related Insights
- OWASP MCP Top 10 Explained for Business Owners
- Microsoft Execution Containers: How to Contain an AI Agent
- Why AI Agents Are Getting Their Own Infrastructure
Sources
- SiliconANGLE, New MCP specification kills old risks, opens fresh attack surfaces, Akamai finds, June 25, 2026
- Model Context Protocol
'/%3e%3cellipse%20cx='350'%20cy='480'%20rx='380'%20ry='170'%20fill='%238a5fd1'%20filter='url(%23blur)'%20opacity='1'/%3e%3cellipse%20cx='1060'%20cy='500'%20rx='345'%20ry='165'%20fill='%232f9e8f'%20filter='url(%23blur)'%20opacity='1'/%3e%3crect%20width='1376'%20height='768'%20filter='url(%23grain)'%20opacity='1'%20style='mix-blend-mode:overlay'/%3e%3c/svg%3e)
'/%3e%3cellipse%20cx='350'%20cy='480'%20rx='380'%20ry='170'%20fill='%234a7fd0'%20filter='url(%23blur)'%20opacity='1'/%3e%3cellipse%20cx='1060'%20cy='500'%20rx='345'%20ry='165'%20fill='%23e0709a'%20filter='url(%23blur)'%20opacity='1'/%3e%3crect%20width='1376'%20height='768'%20filter='url(%23grain)'%20opacity='1'%20style='mix-blend-mode:overlay'/%3e%3c/svg%3e)
'/%3e%3cellipse%20cx='350'%20cy='480'%20rx='380'%20ry='170'%20fill='%23e0709a'%20filter='url(%23blur)'%20opacity='1'/%3e%3cellipse%20cx='1060'%20cy='500'%20rx='345'%20ry='165'%20fill='%236b5bd6'%20filter='url(%23blur)'%20opacity='1'/%3e%3crect%20width='1376'%20height='768'%20filter='url(%23grain)'%20opacity='1'%20style='mix-blend-mode:overlay'/%3e%3c/svg%3e)