MCP’s Largest Update Helped AI Agents Scale—and Transformed a Prompt into a Password.

MCP's July 28 Stateless Update Creates Four Handle Checks

Meta Description: MCP's July 28, 2026 stateless update turns session handles into conversation text, so servers must verify signature, audience, expiry, and caller.

Tags: MCP handle security, Model Context Protocol, AI agent security, OAuth 2.1, prompt injection

Featured Image: Abstract friendly illustration of a signed session ticket floating inside a chat bubble, protected by four locks, with soft cloud shapes, no real people, no logos, no text.

On July 28, 2026, the Model Context Protocol (MCP) shipped its largest update, making the protocol fully stateless and moving session credentials into the model's own conversation, the most public place in an agent system. For anyone building or running AI agents, MCP handle security now depends on four checks that every server should perform on each request: signature, audience, expiry, and caller. The change lets agent tools scale like normal web services, but it also turns a short text string into a usable pass, much like a boarding pass barcode that can be scanned by the wrong person.

Why the July 28 MCP update matters

MCP is the layer that lets AI agents call tools, read files, and hit APIs for users. If an agent books a meeting, updates a Jira ticket, or queries a database, MCP may be the path in between. Its governance also makes changes broad. Anthropic donated MCP to the Agentic AI Foundation (AAIF) when the Linux Foundation-hosted body launched on December 9, 2025. Anthropic, OpenAI, and Block co-founded AAIF, with platinum members including AWS, Bloomberg, Cloudflare, Google, and Microsoft. The foundation passed 170 member organizations in its first four months.

The July 28 release made three moves. First, MCP became fully stateless: the old initialize handshake and the Mcp-Session-Id header disappeared, so each request can stand alone behind a normal cloud load balancer. Second, authentication became stricter: the spec aligns more closely with OAuth and adds an Enterprise Managed Authorization extension built with Okta, allowing corporate identity providers to gate MCP access directly. Third, a formal deprecation policy arrived, giving enterprises roughly a year, or a 12-month migration window, before old features are removed.

None of these moves was cosmetic. They let MCP grow like ordinary web infrastructure. But going stateless raised a hard question: if the server no longer remembers the session, who does?

How a valid handle can become a stolen credential

The stateless design needs a portable handle. A handle is a short credential string, such as h_9f2c41ab, issued by a server and later passed back by an agent. The catch is location. The handle sits in the model's context window, where the model sees it as ordinary text. Anything able to place text in front of the model can also read that text and reuse it.

The airline analogy is the warning: the system sees a valid code and acts, without checking who holds the phone. Signing a handle helps, but it does not solve the whole problem. A signature, like a JWT, can prove a handle was not forged. It cannot prove the right caller is presenting it. The security guidance in the specification says servers must not treat possession of a state handle as authentication. In plain terms, a valid barcode is not proof that it is your flight.

A planted sentence can exploit this. Suppose an agent working for Sarah receives a real, correctly signed handle for her report. Later, the agent reads a Jira ticket, a scraped web page, or a tool response containing hidden instructions. Those instructions tell the model to call a tool using Sarah's handle. The server checks the signature, sees it is valid, and lets the call through. No server was hacked, and no token vault was breached. Researchers now call this pattern handle hijacking: prompt injection is the method, and a stolen handle is the prize.

The risk is not theoretical. MCP already has a record of exploited flaws, not only reported ones, including five incidents spanning CurXecute to the Miasma worm. Knostic reported an internet scan finding 1,862 MCP servers exposed with no authentication at all. The exposure numbers make this an enterprise story, not just a developer-tools story. The NSA AI Security Center has warned that MCP adoption moved faster than its security model. If handles are added to weak servers, a stolen handle can be replayed.

Four checks close the replay gap

The fix is not exotic. You do not need a blockchain, a new consensus system, or a wider broadcast of credentials. A distributed ledger can help strangers agree on shared history, but sending a bearer credential to more nodes only expands exposure. Instead, each request should pass four questions. A basic implementation can be expressed as a few checks, even in a few lines of Python.

Check one verifies the signature. Check two verifies audience binding: a handle issued for server A should not work at server B. Check three verifies a short lifetime, so a leaked handle is useful only in a narrow window. OAuth 2.1 already pushes in both directions. Check four is the one most teams skip. It verifies the caller by tying the handle to the identity it was issued to. A copied string should be worthless in someone else's hands.

This marks a real shift. Session enforcement used to live deep in the transport layer, often invisible to most developers. Now it must be rebuilt on purpose at every endpoint. The protocol will not do that automatically.

What migrations should do now

The 12-month clock to adopt the new spec began in the same month researchers identified the handle hole. That is not a reason to remain on the older design, which has well-documented problems. It is a reason to treat the migration as a security project rather than a routine upgrade.

Three practical steps follow directly from the attack path. First, check at the request level and do not trust anything cached in session state. Every call gets verified on its own. Second, treat every handle as untrusted input, the same way as a string coming from a tool response or a document read by an agent. Verify audience, expiry, and caller, not only the signature. Third, put an identity-aware gate in front of every MCP server, rejecting calls that lack a valid, audience-bound token before they reach a tool. Where possible, strip or flag instruction-like text in tool outputs, because that is where planted handle requests can arrive.

The stateless model still makes sense for scaling. Dropping server-side sessions lets MCP scale like normal web infrastructure. The problem is not the architecture; it is where the credential now lives. A signature is not an identity. A real handle planted through a poisoned Jira ticket still passes a signature check. Four checks close most of the gap by making a replayed handle fail on its own. A boarding pass photo feels harmless because the barcode looks decorative. A handle inside an agent's context window feels harmless for the same reason. The agent's context window is the Instagram post. Check more than the barcode. Check who is holding it.

Source note: This article draws on MCP 2026-07-28 security guidance, Agentic AI Foundation notes, Knostic scan reporting, NSA AI Security Center guidance, Backslash Security reporting from 2026, VentureBeat reporting from January 27, 2026 and September 2026, and analysis by Swapnali Dashrath, a Senior AI Solution Architect with 20+ years of enterprise AI and machine learning experience designing agentic AI and multi-agent systems for Fortune 10 and Fortune 100 clients in financial services, automotive, and supply chain. The original story was first published in Towards AI on Medium.