The Model Context Protocol just shipped its largest update since launch, and the headline change isn't a new feature — it's a fix for how MCP handles who's actually on the other end of an authorization flow. According to VentureBeat's coverage of the release, the release ships significant authorization hardening, aligning MCP's auth specification with how OAuth 2.0 and OpenID Connect are actually deployed in practice, and most notably the protocol now enforces mandatory validation of the issuer (iss) parameter — a protocol-level defense that closes an entire class of so-called mix-up attacks, in which a client can be tricked into associating an authorization response with the wrong identity server. This matters because MCP servers sit at the junction where an AI agent's credentials get checked before it's allowed to touch a calendar, a database, or an internal tool. A mix-up attack exploits exactly the kind of trust confusion that agent-to-tool authentication depends on: if a client can be fooled into trusting the wrong issuer, every downstream permission check inherits that error. Mandating iss validation is a narrow but structural fix — it closes a hole rather than papering over symptoms. Notably, the maintainers describe this as preventive, not reactive engineering. Asked whether anyone was actually attacked, the spokesperson Delimarsky said no — this was preventive engineering, not incident response, adding "this is not something that is gated in any existing vulnerabilities or active exploitation." That's a healthy signal for a protocol still early in its adoption curve: hardening the identity layer before it gets exploited at scale, rather than after. The same release also moves MCP toward a stateless architecture, dropping the session-ID system that has made large-scale MCP servers hard to run and clearing a path for enterprise-grade agent deployments behind load balancers. That's an operational change, but it's the auth hardening that has teeth for accountability: session state was never really where trust lived — the issuer check is. More is coming, too: proposals are already on deck for demonstrated proof-of-possession and workload identity federation, capabilities requested by security teams running MCP in production. The pattern worth watching: as MCP, A2A, and AP2 all mature, the identity layer keeps getting retrofitted after the fact rather than designed in from the start. This update is a sign that maintainers are starting to treat issuer trust as core protocol surface, not an afterthought bolted onto OAuth. That's the right direction, but it's also a reminder of how much of today's agent infrastructure still needs the same treatment.