Topic starter
14/08/2026 6:35 pm
TL;DR: MCP's shift to stateless sessions, removal of Roots, and addition of MCP Apps create endpoint-layer attack surfaces that network and gateway tools cannot see, according to Backslash Security. The governance gap is now structural: filesystem scope, handle validation, and IDE-rendered trust all move outside conventional review and inspection models.
Editorial analysis by NHI Mgmt Group, based on content published by Backslash Security: “New MCP Spec Opens Three New Attack Surfaces. Security, Get Ready.”.
Key questions
Q: What breaks when MCP moves from a stateful session to stateless requests?
A: The old assumption that trust can be carried by a long-lived session breaks first.
Q: Why does removing Roots create a real filesystem governance problem for AI agents?
A: Because Roots was the structural boundary that limited which local paths an agent could reach.
Q: How can security teams tell when MCP App trust is becoming unsafe?
A: The warning sign is when approval flows, login prompts, or configuration forms are rendered inside the IDE by server-controlled HTML.
Practitioner guidance
- Inventory conversation-held handles Map every MCP implementation that returns handles or requestState into the conversation, then verify whether the server binds that value to the original user and resource context on every request.
- Re-establish filesystem scope controls Identify local MCP servers that can reach credential stores, .env files, or other secrets-bearing paths, and require explicit path allowlists before those servers can operate on developer endpoints.
- Review IDE-rendered MCP UI Treat any HTML delivered through MCP Apps as untrusted supply-chain content and require review of approval dialogs, authentication prompts, and embedded actions before enabling them on endpoints.
Bottom line: MCP’s stateless redesign moves access control from server-managed sessions into endpoint-held handles, which makes replay and leakage materially easier to govern poorly.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:42 pm
Stateless handles create an identity trust debt: once access state moves into the conversation, the control ceases to be server memory and becomes whatever the model, logs, or transcript preserve. That is a structural change in NHI governance because the access token is now socially and operationally distributed across systems that were never intended to hold it. Practitioners should treat replayability as a design defect, not a narrow hardening issue.
A few things that frame the scale:
- Gartner predicts that by the end of 2026, 40% of enterprise apps will feature task-specific AI agents.
A question worth separating out:
Q: Should organisations treat gateway and DLP controls as enough for MCP security?
A: No. Gateway tools only see network traffic, while the article’s risk shifts into handles in conversations, local filesystem access, and IDE-rendered UI. Organisations need endpoint visibility and per-server validation because the most important trust decisions are now made outside the network boundary.
👉 Read our full editorial: MCP stateless sessions open new endpoint attack surfaces