Notifications
Clear all
Topic starter
14/08/2026 6:35 pm
TL;DR: MCP's shift to stateless sessions, removal of Roots, and addition of MCP Apps create endpoint-layer attack surfaces that network and gateway tools cannot see, according to Backslash Security. The governance gap is now structural: filesystem scope, handle validation, and IDE-rendered trust all move outside conventional review and inspection models.
NHIMG editorial — based on content published by Backslash Security: New MCP Spec Opens Three New Attack Surfaces. Security, Get Ready
By the numbers:
- 53% of MCP servers expose credentials through hard-coded values in configuration files.
Questions worth separating out
Q: What breaks when MCP access state moves into conversation context?
A: The main break is that access objects become portable, visible, and replayable in places session-based controls were never designed to inspect.
Q: Why do MCP servers create governance problems for endpoint security teams?
A: Because the effective control boundary moves onto the developer endpoint, where local files, IDE rendering, and tool execution all sit outside network inspection.
Q: What do security teams get wrong about filesystem controls in MCP?
A: They assume filesystem scope is still structurally enforced when in fact it may be optional and inconsistent across servers.
Practitioner guidance
- Bind handles to user context and expiry Require every portable handle to validate the creating user, the current requester, and the expected lifetime.
- Inventory every local MCP server and its filesystem scope Map which MCP servers run on developer endpoints, what paths they can touch, and whether scope enforcement is structural or optional.
- Review MCP Apps as privileged endpoint UI Approve only the servers allowed to render interactive HTML in the IDE, and define review criteria for UI mimicry, credential prompts, and action-triggering controls.
What's in the full article
Backslash Security's full post covers the endpoint-level detail this analysis intentionally leaves for the source:
- A deeper walkthrough of the new MCP stateless model and the exact handle replay conditions it creates.
- The full filesystem-scope discussion, including how Roots removal changes enforcement across local and remote servers.
- Specific examples of MCP Apps UI abuse patterns, including credential mimicry inside the IDE.
- The article's before-July-28th checklist for teams that need to inventory local servers and review exposure.
👉 Read Backslash Security's analysis of new MCP spec attack surfaces →
MCP stateless sessions and endpoint risk: are controls ready?
Explore further
14/08/2026 6:42 pm
Stateless access breaks the assumption that identity state stays server-side. MCP's move from session IDs to handles reverses a long-standing control premise: that access state is stored and enforced outside the model's conversational surface. Once the handle lives in prompts, tool outputs, and logs, the access object becomes portable in ways classic session governance was not built to absorb. The implication is that identity teams must stop treating conversation context as a neutral transport layer and start treating it as part of the access control plane.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface.
- Our research also found that only 44% of organisations have implemented policies to govern AI agents, leaving most deployments ahead of policy maturity.
A question worth separating out:
Q: Who is accountable when a server-rendered MCP interface tricks a developer?
A: Accountability sits with the organisation that approved the server, the team that allowed endpoint-level rendering, and the governance function that failed to classify the IDE as part of the trust boundary. Once interactive HTML can trigger tool calls, standard web assumptions no longer protect the user.
👉 Read our full editorial: MCP stateless sessions open new endpoint attack surfaces
