MCP overhaul removes old risks, adds new attack surfaces

Akamai researchers found the MCP 2026-07-28 specification removes protocol-managed sessions and server-initiated prompts, eliminating session hijacking and unsolicited request vectors. Mandatory OAuth 2.1 with PKCE cuts authentication risk. The tradeoff shifts security enforcement to developers, creating new implementation-dependent attack surfaces.