New Enterprise-Ready MCP Specification Brings New Security Challenges

The Model Context Protocol (MCP) is evolving from a single-user AI tool to an enterprise-ready platform designed for cloud-native AI usage, with a major update slated for July 28, 2026. This transition introduces new security challenges due to the protocol's shift to a stateless model and the addition of features like UI apps and asynchronous tasks. While the protocol itself removes some vulnerabilities, the expanded attack surface created by implementation choices presents significant risks, particularly around workflow hijacking, data leakage, and denial-of-service attacks.