On July 28, 2026, the Model Context Protocol (MCP) underwent a fundamental architectural revision, removing protocol sessions and the Mcp-Session-Id header. This change renders the protocol layer stateless. While this simplifies the protocol, it effectively offloads the entire burden of state management and security enforcement onto individual implementations. The ecosystem, already struggling with basic security hygiene, is now forced to manage complex authentication and session integrity without the safety net of a stateful protocol layer.
The NSA and DoD issued a joint Cybersecurity Information Sheet on May 20, 2026, warning that the rapid adoption of MCP has significantly outpaced the development of necessary security safeguards. This warning is now underscored by the protocol’s shift to statelessness. By removing session-level tracking, the protocol assumes that developers will implement robust, secure state management at the application level. Current evidence suggests this is an optimistic assumption.
The existing vulnerability landscape is extensive. Trend Micro recently identified 492 network-exposed MCP servers operating without any form of authentication or encryption, leaving 1,402 tools directly accessible to unauthorized actors. Furthermore, research from BlueRock Security indicates that 36.7% of over 7,000 scanned MCP servers are potentially vulnerable to Server-Side Request Forgery (SSRF). These baseline vulnerabilities are now compounded by the architectural shift, as statelessness complicates the tracking of requests and the enforcement of consistent security policies.
The most critical threat currently facing the ecosystem is agentjacking. Disclosed by Tenet Security in June 2026, this attack class exploits MCP-connected services, such as Sentry, to hijack AI agent workflows. The attack demonstrated an 85% success rate across major platforms, including Claude Code, Cursor, and the OpenAI Codex CLI. By manipulating the interaction between the agent and the tool, attackers can execute unauthorized commands, effectively turning the agent against the user.
Statelessness introduces a new class of attack vectors that developers must now mitigate. Workflow hijacking via predictable identifiers is a primary concern, as the lack of session-bound tokens makes it easier for attackers to inject or intercept requests. Additionally, the protocol now faces risks from header and body inconsistencies, where malicious actors may exploit discrepancies in how different implementations parse stateless requests. The shift also enables hit-and-run Denial of Service (DoS) attacks against asynchronous tasks, which are no longer tied to a persistent session.
The introduction of the MCP Apps extension further expands the attack surface. This feature allows servers to ship interactive HTML interfaces directly alongside tool responses. While this enhances functionality, it introduces browser-based threats into the agent environment. If an MCP server is compromised, it can now deliver malicious content directly to the developer’s interface, bypassing traditional security boundaries.
To address these risks, the protocol now mandates hardened authorization aligned with OAuth 2.0 and OpenID Connect. Clients are required to validate the iss (issuer) parameter on authorization responses, as specified in RFC 9207. While these are standard security practices, their implementation is now mandatory for any secure MCP deployment. The reliance on these standards highlights the shift: security is no longer a protocol-level guarantee but an implementation-level requirement.
The gap between the protocol’s increasing maturity and the ecosystem’s readiness is widening. While the July 28 revision provides a cleaner, more scalable architecture, it assumes a level of security sophistication that is currently absent in many deployments. Organizations adopting MCP must now treat every tool connection as a potential entry point for sophisticated attacks. Until the ecosystem adopts rigorous, standardized security implementations, the shift to statelessness will likely increase the frequency and impact of successful exploits.