MCP got safer in one way and riskier in five

What happened

The Model Context Protocol, or MCP, is the standard many teams use to let AI agents call tools and reach company data. In June 2026, Akamai published an analysis of its newest specification.

On the plus side, the spec drops protocol-managed sessions, which removes a way to hijack a user by stealing a long-lived session ID. It restricts server-initiated prompts, and it moves authentication to OAuth 2.1 with PKCE required.

On the other side, Akamai flagged new surfaces:

• Client-held state. The server hands the client a state object and gets it back later. A predictable ID or an unchecked object could let one user step into another's workflow or tenant.
• Unsigned metadata. A new field carries client-supplied values with no signature. If a server trusts it for routing or permissions, it can be forged.
• Header and body mismatches. A proxy may read one thing and the server another, letting bad traffic slip past controls or logs.
• Secrets in headers. A directive that copies tool arguments into HTTP headers can leak keys or personal data into every proxy and log along the path.
• Resource exhaustion. An attacker can start expensive long-running tasks, disconnect, and leave the server burning resources.

Akamai also noted a risk of stored scripts in interactive MCP panels.

So what for your business

The overall shift is that security moved from the protocol to the people building on it. The standard no longer protects you from your own integration choices.

That matters because agent integrations are usually built quickly, and often by people who are experts in AI rather than in web security. They also tend to have real access: customer data, ticketing systems, code.

What to do this month

1. Inventory your MCP servers. Who built each, what it can reach, and who approved the access.
2. Treat client-sent state and metadata as untrusted. Verify it, and sign anything you rely on.
3. Check what flows into headers. Make sure secrets and personal data never do.
4. Set quotas on long-running tasks. Per user, per tenant, with timeouts.
5. Review before connecting new tools. Give agents the narrowest access that gets the job done.