Loading story…
A change to the Model Context Protocol (MCP) stateless core did not remove session risk so much as relocate it to application-layer identifiers that large language models must preserve across turns. The reported design leaves servers relying on models to correctly carry and replay values such as basket IDs, browser IDs, and tenant-linked handles, creating opportunities for silent misrouting, cross-tenant actions, workflow hijacking, and unauthorized data access when a model drops context or uses the wrong identifier.
The warning is reinforced by research on multi-turn degradation in LLMs, including the paper LLMs Get Lost In Multi-Turn Conversation, which found models struggle as conversations lengthen and information must be retained accurately across turns. The report also cites a Red Hat incident in which an agent chose the wrong account despite the correct identifier being present in prompt context, underscoring that valid-looking but incorrect requests can still succeed. Recommended defenses include per-request authorization of handles, short-lived high-entropy identifiers, idempotency keys, and testing agent workflows at deeper conversation turn counts.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
On July 28, 2026, the Model Context Protocol changed to a stateless core that removed protocol-managed session state such as session identifiers and negotiated session correlation. Servers needing cross-call state were instead directed to mint explicit handles like basket IDs or browser IDs and rely on the model to pass them back in later tool calls.
The paper "LLMs Get Lost in Multi-Turn Conversation" reported results from more than 200,000 simulated conversations across fifteen leading open- and closed-weight models. It found substantial degradation in multi-turn settings, including a 39% average performance drop, about 16% lower aptitude, and 112% higher unreliability, with function calling among the tested tasks.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two Gopher Security posts argue that **Model Context Protocol (MCP)** deployments create a high-risk “all-or-nothing” context-sharing pattern where tools/servers may over-collect sensitive data (e.g., pulling full database rows or entire medical histories to answer a narrow eligibility question), increasing breach impact, compliance exposure, and the value of centralized “AI context” stores as attacker targets. They propose shifting to *need-to-know* context validation using **zero-knowledge proofs (ZKPs)** so systems can prove attributes (e.g., spending thresholds, eligibility) without disclosing underlying personal data, and emphasize governance controls to reduce over-sharing in MCP-based integrations. A separate Gopher Security post frames MCP security in terms of “quantum-era” cloud security pillars—**IAM**, **data protection**, **network segmentation**, and **visibility/compliance**—and recommends **post-quantum cryptographic agility** to address “harvest now, decrypt later” risk for sensitive training and context data, alongside context-aware/service-to-service authorization to prevent rogue tools/agents from accessing model weights or data sources. A THOR Collective Dispatch article is largely practitioner guidance on how to use LLMs for security work (terminology and workflow patterns) and does not materially address MCP governance, ZKPs, or post-quantum controls, so it does not substantively contribute to the specific MCP security/privacy topic.
Jun 29, 2026
Attackers have increasingly targeted exposed large language model (LLM) services and the protocols that enable their integration, such as the Model Context Protocol (MCP). GreyNoise researchers observed nearly 100,000 attack sessions against public LLM endpoints, with campaigns probing for misconfigured proxies and server-side request forgery vulnerabilities to map the expanding AI attack surface. These attacks, which included methodical enumeration of OpenAI-compatible and Google Gemini endpoints, highlight the growing risk as enterprises move LLM deployments from experimental to production environments. Security experts warn that such enumeration efforts are likely precursors to more serious exploitation, emphasizing the need for organizations to secure exposed LLM endpoints and monitor for abnormal access patterns. The Model Context Protocol (MCP), designed to facilitate seamless integration between LLMs and external tools, has also been identified as a double-edged sword. While MCP enables powerful automation and workflow enhancements, it extends the attack surface by embedding trust in external products and services, making it susceptible to exploitation by adversaries who manipulate context layers and metadata. Security leaders, such as Block's CISO, stress the importance of applying least-privilege principles and rigorous red-teaming to AI agents and integration protocols, recognizing that both human and machine actors can introduce significant risks. As LLMs and AI agents become ubiquitous in enterprise environments, organizations must adapt their security frameworks to address these novel attack vectors and integration challenges.
Jun 30, 2026
The Model Context Protocol (**MCP**) is undergoing a wire-level redesign that replaces session-based connections and initialization handshakes with a stateless, request-centric model aimed at simplifying deployment and horizontal scaling. Under the release candidate, protocol version, client capabilities, and client identity move into per-request metadata, while routable transport headers, deterministic caching behavior, and a new `server/discover` method are intended to make remote MCP servers easier to run behind standard cloud load balancers without session affinity, shared session stores, or MCP-specific routing logic. The update also adds Multi Round-Trip Requests, interactive MCP Apps, and an authorization framework built on **OAuth 2.1** and **OpenID Connect**, while deprecating legacy features including Sampling, Roots, Logging, the older HTTP+SSE transport, Dynamic Client Registration, Tasks, and some server-initiated request patterns. Developers face potentially significant migration work, particularly where servers relied on Sampling or persistent session machinery, but updated SDKs for Python, TypeScript, Go, and C# support both old and new protocol versions during a transition period that includes beta tooling, validation, and minimum deprecation windows.
Jul 29, 2026