The MCP specification is transitioning from a local, single-user AI integration tool to an enterprise-scale, cloud-native platform with a stateless protocol layer. This shift removes certain classes of vulnerabilities like session hijacking and unsolicited server prompts but introduces new security challenges that depend heavily on implementation quality. Key risks include predictable tracking identifiers that could lead to hijacking or unauthorized access, leakage of sensitive data through MCP-specific HTTP headers, denial-of-service attacks via resource-intensive long-running tasks, and traditional web browser risks such as stored cross-site scripting due to MCP Apps becoming first-class protocol extensions. The protocol itself is not inherently more vulnerable; rather, the expanded attack surface arises from how MCP servers implement the new specification. Security boundaries previously enforced by the protocol are now delegated to developers and platform operators, increasing their responsibility for securing MCP deployments.

The impact includes potential workflow hijacking, unauthorized cross-tenant data access, privilege escalation, leakage of sensitive secrets through HTTP headers, denial-of-service attacks targeting server resources, and execution of malicious scripts via insecure UI components. These issues could compromise confidentiality, integrity, and availability of MCP-based services if implementations are flawed. However, no known exploits are currently reported in the wild. The transition to a stateless protocol fundamentally changes the security model, requiring enterprises to carefully manage new risks introduced by implementation choices.

No official patch or fix is applicable since this is a protocol specification change rather than a software vulnerability. Enterprises and developers must thoroughly review and validate their MCP server implementations against the new MCP 2026-07-28 specification before the July 28, 2027 deprecation deadline for legacy versions. Emphasis should be placed on securely handling tracking identifiers, protecting sensitive data from exposure in HTTP headers, mitigating denial-of-service risks from long-running tasks, and securing MCP Apps against web-based attacks such as cross-site scripting. Security teams should prioritize understanding the new security responsibilities delegated to implementation and platform operators and apply best practices accordingly. Patch status is not yet confirmed as this is a protocol evolution; check vendor advisories and MCP specification updates for ongoing guidance.