Loading story…
The Model Context Protocol (MCP) has been updated to a fully stateless design in the 2026-07-28 specification, removing required sessions, the initialize handshake, and the Mcp-Session-Id header so MCP servers can run as standard HTTP services without sticky-session infrastructure. The update also replaces stream-dependent elicitation with Multi Round-Trip Requests, adds MCP-specific HTTP headers for gateway and security controls, and tightens authorization through issuer identification and canonical resource audience handling. Cloudflare said its Agents SDK and Workers OAuth Provider already support the new model, and cited production adoption by Sentry and Linear.
At the same time, major vendors including OpenAI, AWS, Cursor, GitHub, Microsoft, and Vercel backed Agent Plugins 1.0.0, a vendor-neutral format for packaging MCP servers and agent skills for use across clients and runtimes. The push for interoperability comes with growing security concerns: researchers published new Nuclei templates to detect publicly exposed AI agent configuration files such as CLAUDE.md, AGENTS.md, Cursor rules, and vscode-mcp.json, warning that misconfigured web roots can leak internal workflows, tool settings, and project conventions as organizations expand AI agent deployments.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
The Model Context Protocol 2026-07-28 specification was released, changing MCP from a stateful protocol to a fully stateless one. The release removed required protocol sessions, the initialize handshake, and the Mcp-Session-Id header, and introduced related SDK updates and deprecations.
Agent Plugins 1.0.0 was released as an open, vendor-neutral package format for portable AI agent extensions, packaging Agent Skills and MCP servers into distributable plugins. The article says Vercel initiated the proposal and that OpenAI, AWS, Cursor, GitHub, and Microsoft backed the standard.
A Nuclei pull request introduced detection templates for publicly exposed AI coding-agent instruction and configuration files such as CLAUDE.md, AGENTS.md, Cursor rules, and .cursor/mcp.json. The submission states the templates validated successfully and matched expected paths in fixture smoke tests.
Cloudflare said its Agents SDK supported the new MCP specification from day one, and that customers and partners had already used the release candidate on Cloudflare before finalization. Cloudflare also said its Workers OAuth Provider implements the new authorization requirements.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
thenewstack.io
Open sourceblog.cloudflare.com
Open sourcegithub.com
Open sourcemodelcontextprotocol.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security reporting and research warned that the **Model Context Protocol (MCP)** has opened a new attack surface for enterprise AI agents, allowing malicious content delivered through context windows, documentation, support tickets, GitHub issues, or untrusted MCP servers to trigger unauthorized actions without compromising the underlying model. Reported examples included WhatsApp data exfiltration, leakage of private repository data, abuse of a Supabase Cursor agent through crafted support tickets, and **`CVE-2025-6514`**, a high-severity OS command-injection flaw that could enable remote code execution via untrusted MCP servers. A separate proof-of-concept targeting Andrew Ng’s **Context Hub** showed how poisoned API documentation served through an MCP server could silently steer coding agents into adding fake or malicious dependencies to generated projects, highlighting a software supply-chain risk in community-authored documentation pipelines. Across the coverage, researchers and vendors said perimeter controls and AI gateways are not enough because attackers or insiders can interact directly with MCP services; they urged organizations to treat MCP connectivity as privileged access, sanitize all context inputs, enforce policy and approval checks at the MCP server, restrict agent network and data access, and adopt zero-trust execution controls with auditable action receipts.
Jul 23, 2026
Two newly disclosed vulnerabilities affected software built around the **Model Context Protocol (MCP)**, highlighting security weaknesses in AI-agent tooling. **CVE-2026-63119** impacts the MCP Ruby SDK distributed as the `mcp` gem before version `0.23.0`, where unbounded reads from stdio streams can let a connected peer or spawned subprocess send newline-free data until memory is exhausted, causing denial of service. Separately, **CVE-2026-54785** affects the `gemini-bridge` MCP server's file-handling logic, where improper path validation in `_resolve_path` allows directory traversal and local file disclosure outside the configured workspace, potentially exposing sensitive files through Gemini query responses. The disclosures come as MCP adoption expands and security guidance around AI-agent integrations matures. The MCP specification and introduction describe the protocol as a standard way to connect models with external tools and data sources, while recent security research has warned that tool-calling systems introduce risks including prompt injection, excessive privilege, SSRF, and data leakage. In parallel, the OpenID Foundation published draft **COAZ** and **COAZ-MCP** specifications to bring standardized authorization to MCP message flows before tool execution, and practitioner research on MCP deployments has emphasized authentication, input validation, logging, and least-privilege design as necessary safeguards for enterprise use.
Aug 1, 2026
Cloudflare has introduced **WriteGuard**, a private beta security layer for Model Context Protocol (**MCP**) servers that intercepts agent requests, enforces tool-specific policies, and logs blocked or failed actions for centralized auditing. The service is designed to curb the risk of AI agents using existing OAuth-backed access to perform sensitive write operations across databases, internal APIs, GitHub, GitLab, Jira, Google Workspace, SaaS platforms, and internal wikis. Cloudflare said WriteGuard can apply consistent controls across multiple MCP servers without requiring changes to each server, while preserving attribution by tying MCP client and session context to the human user and scrubbing sensitive values before audit events are stored. The launch comes as MCP-connected tools are gaining direct write access to production workflows. ElevenLabs recently introduced a hosted MCP connector that lets Claude inspect and modify **ElevenAgents** configurations, including changing prompts, voices, languages, retrieving transcripts, generating sample speech, estimating costs, and even deleting agents from a chat interface. ElevenLabs said it uses OAuth plus organization- and session-level controls and urged users to review tool calls before approval, warning that approval alone does not guarantee safe or correct downstream behavior; the company also pointed teams to testing, versioning, and CLI/API-based rollout practices for stronger governance.
Aug 20, 2026