MCP stateless sessions open new endpoint attack surfaces

At a glance

What this is: This analysis argues that MCP’s stateless redesign shifts core security risk from the server session layer to the endpoint, where handle replay, filesystem overreach, and IDE-rendered UI can expose data and credentials.

Why it matters: It matters because IAM and NHI teams must now govern conversation-held handles, local server scope, and interactive agent UI as endpoint problems, not just network or gateway problems.

Context

MCP’s latest spec changes remove a familiar assumption from identity and access control: that state can stay server-side and be enforced through a session. Once handles move into the conversation and boundaries become opt-in, the control point shifts from protocol-managed state to endpoint-managed trust.

For NHI governance, that matters because AI agents, local MCP servers, and IDE-rendered interfaces now carry access decisions in places conventional gateway tooling cannot see. The article’s central claim is that the protocol change does not eliminate state, it relocates it into a more exposed control plane.

The practical consequence is that scope, replay protection, and user-to-handle binding become implementation details for each server and client ecosystem. That is a weaker operating model than structural enforcement, and it raises the bar for inventory, validation, and local runtime monitoring.

Key questions

Q: What breaks when MCP moves from a stateful session to stateless requests?

A: The old assumption that trust can be carried by a long-lived session breaks first. Security teams now need to validate each request independently, because protocol version, client identity, and capability context arrive as data rather than as durable connection state. That changes how authorization evidence is established and audited.

Q: Why does removing Roots create a real filesystem governance problem for AI agents?

A: Because Roots was the structural boundary that limited which local paths an agent could reach. Without it, scope becomes opt-in per server, so sensitive directories can be reachable even when the task does not require them. That makes scope enforcement a server obligation rather than a protocol guarantee.

Q: How can security teams tell when MCP App trust is becoming unsafe?

A: The warning sign is when approval flows, login prompts, or configuration forms are rendered inside the IDE by server-controlled HTML. At that point, the endpoint is no longer just executing tools, it is displaying trust decisions. Teams should review that interface path as part of access governance.

Q: Should organisations treat gateway and DLP controls as enough for MCP security?

A: No. Gateway tools only see network traffic, while the article’s risk shifts into handles in conversations, local filesystem access, and IDE-rendered UI. Organisations need endpoint visibility and per-server validation because the most important trust decisions are now made outside the network boundary.

Technical breakdown

Handle replay in stateless MCP sessions

A stateless MCP session removes the server-managed session token and replaces it with a portable handle that lives in the conversation. That changes the security primitive from opaque, server-invalidated state to a replayable string that can be copied, logged, or forwarded. The critical check is no longer only whether the handle exists, but whether it is still bound to the same user, request context, and resource state. If the server accepts the handle without re-validating that binding, a valid value becomes a reusable access artifact across conversations and requests. Practical implication: treat every handle as a user-bound credential, not a harmless reference string.

Practical implication: Bind handles to user context and reject replay when the requestor or conversation changes.

Why removing Roots breaks filesystem scope enforcement

Roots used to be a structural scope boundary, telling the server which filesystem paths an agent could reach. Without that capability, scope becomes opt-in logic implemented by individual server developers, not a protocol guarantee. That is a governance loss, not just an implementation change: the platform no longer enforces a universal deny-by-default perimeter around sensitive local files such as credential stores, .env files, and API keys. The result is that task scope and data scope can diverge silently. Practical implication: assume filesystem access is uncontrolled unless the specific server proves otherwise.

Practical implication: Require explicit path scoping and audit local MCP servers that can reach secrets-bearing directories.

MCP Apps turn trusted IDE surfaces into server-rendered content

MCP Apps introduces interactive HTML that renders inside an IDE iframe and can trigger tool calls back to the server. That creates a trust inversion because the rendering context is no longer a browser tab with mature origin controls, but the developer’s own IDE, where source code, terminal access, and connected servers already coexist. The risk is not limited to cross-site scripting. UI mimicry, clickjacking, and malicious approval flows can steer a user into entering secrets or approving actions inside what appears to be a native editor prompt. Practical implication: review server-rendered UI as supply-chain content, not as harmless interface chrome.

Practical implication: Review any IDE-rendered HTML and restrict MCP Apps to servers with explicit UI governance.

Threat narrative

Attacker objective: The attacker wants to convert conversation-held state and local endpoint trust into access to secrets, filesystem data, or unauthorized tool execution.

1. Entry begins when a handle, requestState blob, or server-rendered prompt is introduced into the AI conversation and can be reused outside the original context.
2. Escalation occurs when the server accepts the handle or state without binding it to the correct user, letting the agent reach files, secrets, or workflows beyond the intended task scope.
3. Impact follows when the agent exfiltrates credentials, reads sensitive local files, or submits unauthorized tool actions through a trusted endpoint surface.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Stateless handles create an identity trust debt: once access state moves into the conversation, the control ceases to be server memory and becomes whatever the model, logs, or transcript preserve. That is a structural change in NHI governance because the access token is now socially and operationally distributed across systems that were never intended to hold it. Practitioners should treat replayability as a design defect, not a narrow hardening issue.

Filesystem scope is only meaningful when it is structural: the disappearance of Roots means the boundary is no longer guaranteed by the protocol itself. That weakens the assumption that an agent can be limited by a fixed task boundary and creates a governance gap between declared scope and reachable data. The implication is that NHI control models must distinguish policy intent from enforceable perimeter.

MCP Apps turn endpoint UI into part of the attack surface: when the server controls what renders inside the IDE, trust is no longer limited to tool output. The ordinary separation between application, browser, and workstation collapses, which means approval prompts and authentication flows need endpoint-grade scrutiny. Practitioners should treat interactive agent UI as an access path, not a convenience feature.

Handle binding, scope enforcement, and rendered trust should be governed as one control family: the article shows that the protocol’s three changes do not create three separate problems, they create one endpoint governance problem with multiple expressions. That is why conventional network inspection misses the real risk. The field needs a control model that follows the handle, the local file boundary, and the UI surface together.

Endpoint visibility is now a first-class identity control: when state, scope, and approval all shift onto the developer machine, the boundary of NHI governance moves with them. Security teams that keep thinking in terms of gateway enforcement will under-govern the actual access path. The practitioner conclusion is simple: identity security for MCP now lives where execution happens, not where traffic crosses the wire.

From our research library:

• Gartner predicts that by the end of 2026, 40% of enterprise apps will feature task-specific AI agents.
• Read next: Agentic AI Identity Guide

What this signals

Handle-bound trust is the new control problem: the old session model assumed the server could keep state and invalidate it centrally. Once the handle lives in the conversation, identity review has to happen where the string is created, copied, and replayed, not only where the request is received.

Endpoint governance now spans local execution and interactive UI: security teams should expect AI toolchains to blur the line between application, workstation, and identity boundary. The practical response is to map which local MCP servers run on developer machines, which ones expose rendered UI, and where secrets can be reached without network visibility.

The 2026 Infrastructure Identity Survey shows 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, which is the kind of policy gap this MCP change exposes. That gap becomes harder to justify when the control boundary moves from gateway inspection to endpoint trust.

For practitioners

• Inventory conversation-held handles Map every MCP implementation that returns handles or requestState into the conversation, then verify whether the server binds that value to the original user and resource context on every request.
• Re-establish filesystem scope controls Identify local MCP servers that can reach credential stores, .env files, or other secrets-bearing paths, and require explicit path allowlists before those servers can operate on developer endpoints.
• Review IDE-rendered MCP UI Treat any HTML delivered through MCP Apps as untrusted supply-chain content and require review of approval dialogs, authentication prompts, and embedded actions before enabling them on endpoints.
• Separate gateway assumptions from endpoint enforcement Document which MCP risks are invisible to network tools, then assign endpoint controls to local servers, rendered interfaces, and handle validation instead of expecting DLP or gateways to catch them.

Key takeaways

• MCP’s stateless redesign moves access control from server-managed sessions into endpoint-held handles, which makes replay and leakage materially easier to govern poorly.
• The removal of Roots turns filesystem scope from a protocol guarantee into an implementation choice, so local server boundaries matter more than ever.
• Interactive MCP Apps expand the IDE attack surface, which means teams need endpoint-level review for rendered UI, handle validation, and local secret exposure.

Key terms

• Stateless Session Management: Stateless session management keeps user requests independent so servers do not need to retain session state between calls. In microservices, this reduces memory overhead and improves horizontal scaling, but it usually requires tokens, replication, or shared storage to preserve identity and authorization context across requests.
• Package Hijacking: Package hijacking is the compromise of a legitimate package release or maintainer workflow so attackers can distribute malicious code under a trusted name. The risk rises when registries automatically publish new tags or execute package metadata without a strong quarantine step.
• Filesystem Scope: Filesystem scope is the set of paths an agent or server is allowed to touch. In MCP, it is a governance control for local files and secrets, but when it is not structurally enforced it becomes an implementation choice that can drift across servers and environments.
• MCP App: An MCP App is an application that connects to tools, data, or services through the Model Context Protocol. It lets an AI agent request actions or information in a structured way, while the app controls what is exposed, how requests are authorized, and how responses are returned.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.