MCP update removes prompt verification, exposing credentials to theft.

On July 28, the Model Context Protocol (MCP) released its biggest update yet, shifting security responsibilities and exposing a new risk for enterprise tools. The update was rolled out across all four Tier 1 software development kits (SDKs) within a single day, and Cloudflare’s Agents SDK was ready from the start. Companies such as Sentry and Linear immediately adopted the new version, meaning the changes are already live in production.

The new version focuses on scaling and usability. MCP now runs a stateless core that can handle ordinary HTTP traffic, uses OAuth‑native authorization for tighter access control, and supports server‑rendered user interfaces through MCP Apps. The protocol also introduces a 12‑month deprecation policy that locks in these changes until at least mid‑2027, giving developers a clear timeline to migrate.

However, the most significant change is where security enforcement now sits. Earlier versions required the agent software to verify that prompts came from trusted sources before sending any credentials. The new spec moves that verification to the server side, meaning the agent will forward any prompt it receives without checking its origin. This shift turns a simple planted prompt into a potential theft vector: an attacker can trick the agent into sending a user’s credentials to a malicious server, and the agent will comply because it no longer checks the prompt’s source. The change was designed to simplify the agent’s logic, but it also removes a key line of defense.

Developers are reacting with caution. Some are already planning patches that re‑enable prompt validation in the agent, while others are monitoring the new spec’s adoption in their own deployments. The security community is calling for clearer guidance on how to mitigate the new risk without compromising the protocol’s scalability goals. The next step will be to evaluate how many customers rely on the agent in sensitive contexts and to roll out updates that restore the missing checks. This shift highlights the trade‑off between performance and security, and it will be a focal point for future MCP revisions.