Analysis · curated 5 Jul 2026
The New MCP Specification: What Security Teams Must Prepare For
First reported akamai.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
MCP is a rapidly adopted backbone for agentic AI, and the architectural changes reshape the attack surface security teams must defend before the spec goes live.
Akamai analyzes the upcoming MCP 2026-07-28 specification, which moves the Model Context Protocol to a stateless, enterprise-grade architecture with application-managed state, rich interactive UI apps, and long-running async tasks. It argues that while the update eliminates historical risks like protocol-level session hijacking and weak auth, it shifts security boundary responsibility to developers and opens new abuse avenues: unauthorized customer-data access, phishing through trusted AI interfaces, bypass of enterprise controls, and service disruption via background-processing abuse.