The New MCP Spec Opens Three Attack Surfaces: Handle Hijacking, a Filesystem Scope Gap, and HTML in Your IDE

Backslash Security·high signalXBlueskyLinkedInCopy link

Backslash's analysis of the 2026-07-28 spec identifies three concrete new risks. Because state now travels as conversation-visible handles rather than opaque server tokens, a malicious tool response can inject an attacker-controlled ID (`{"task_id": "t-ATTACKER-CONTROLLED"}`) that the model obeys, and handles replay across users unless servers validate (handle + auth context) pairs. Deprecating Roots moves filesystem boundary enforcement from the protocol into individual developer code, making scope opt-in and inconsistent, while the MCP Apps extension (SEP-1865) ships server-controlled HTML into IDE iframes that have access to source code and every connected server — an XSS, clickjacking, or fake-auth-prompt surface.