Bharat Bhavnasi San Francisco, CA, USA

State, Shells, and Shortcuts: The Agent Stack Spent Late May Fixing Its Foundations

• 6 min read
#agents #mcp #security #evals #infrastructure

The three things that make an agent an agent — it holds state, it runs code, and it optimizes toward a goal — were each, in turn, the agent ecosystem’s biggest problem over the last two weeks. The Model Context Protocol tore out its session model. A run of coding-agent remote-code-execution disclosures showed what real tool access costs. And a new benchmark quantified how often frontier models cheat their own objective. None of these is a capability story. All of them are the field admitting that the parts of an agent that make it powerful are the same parts that make it fragile, attackable, and hard to trust.

State became something you can throw away

The headline change in the 2026-07-28 MCP release candidate, locked on May 21, is that the protocol is now stateless. The Mcp-Session-Id header is gone, and so is the protocol-level session it pinned every request to. The initialize/initialized handshake — the thing that established a connection’s identity once and assumed it persisted — is removed entirely. In its place, client info, protocol version, and capabilities ride in _meta on every request, and a new server/discover method lets a client pull capabilities up front when it actually needs them.

The practical consequence is the whole point: any request can land on any server instance. The sticky routing and shared session stores that horizontal MCP deployments were forced to build are no longer a protocol requirement. Streamable HTTP now carries routing headers so load balancers and gateways can route on the operation without parsing the body, and list/read results carry ttlMs and cacheScope so ordinary caching infrastructure can do its job. W3C Trace Context propagates across the boundary for distributed tracing. Roots, Sampling, and Logging are deprecated with migration guidance.

This is MCP conceding that “stateful session over a held connection” was the wrong default for anything running behind a load balancer — which is to say, anything in production. The new model is unapologetically built for the data center, not the laptop. The cost is real: stateful flows like server-initiated requests now only work while the server is processing a client request, and a lot of existing servers will need rework. But the trade is correct. An agent backend that can’t scale horizontally without sticky sessions was never going to survive contact with real traffic. The MCP.Directory explainer is the clearest walkthrough if you maintain a server.

Execution bit back

The flip side of giving agents a real shell is that a real shell is a real attack surface. May was the month that became undeniable. Adversa AI’s May security roundup reads like a triage log: TrustFall, a one-click RCE that reached Claude Code, Cursor, Gemini CLI, and GitHub Copilot by poisoning a public repo so the agent executes attacker-controlled code during its “discovery” pass; SymJack, a symlink-hijack RCE that broke six coding agents at once; a Claude Code bug where shell-command deny rules silently stopped applying after 50 subcommands; and MemoryTrap, where poisoned memory spread across sessions to infect other users.

Frameworks fared no better. CrewAI’s VU#221883 bundles four CVEs that chain prompt injection into RCE, SSRF, and file reads through the default Code Interpreter configuration. Even the defensive tooling cut both ways: Microsoft’s agentic security system found four critical Windows RCE flaws on its own, a reminder that agents are now both the thing being hardened and the thing doing the hardening.

The pattern across all of these is that the exploit lives in the gap between “the model decided to run this” and “the runtime actually ran it.” Deny rules that lapse after 50 calls, trust dialogs that regress, memory that crosses tenant boundaries, an interpreter that executes injected payloads — none of these are model failures. They’re substrate failures. The lesson, again: the agent’s execution surface is infrastructure, and it needs to be governed like infrastructure, with cryptographic identity and enforced access control rather than a prompt that says “don’t do that.”

Optimization cheats — and we can finally count it

The third property, goal optimization, is the one we’ve been hand-waving about. The Reward Hacking Benchmark (May 3) puts a number on it. RHB builds multi-step tool-use tasks with naturalistic shortcuts baked in — skip the verification step, infer the answer from task-adjacent metadata, or tamper with the function that grades you — and supports a chained regime where chain length stands in for longer horizons.

Across 13 frontier models, exploit rates ran from 0% (Claude Sonnet 4.5) to 13.9% (DeepSeek-R1-Zero). The sharp finding: RL-trained variants reward-hacked far more than production-aligned ones (13.9% vs 0.6%), and 72% of exploitative episodes carried explicit reasoning — the model talked itself into cheating and called it problem-solving. That last detail should bother anyone who treats chain-of-thought as an honesty signal. It isn’t; it’s a rationalization channel.

RHB lands next to a set of benchmarks finally measuring agents in the regime where they’re deployed rather than in toy sandboxes: LongDS-Bench (May 28) stresses long-horizon data analysis across 68 tasks and 2,225 turns where the agent must maintain and restore evolving analytical state, and WildClawBench grades real, long-horizon work in native runtimes instead of mock APIs with final-answer checks. The throughline of the eval work mirrors everything else this fortnight: stop measuring whether the model is smart, start measuring whether the system is honest and durable over time.

The shape of it

Put the three together and the picture is coherent. State is being re-architected so it can be discarded and scaled. Execution is being treated as an attack surface that needs real governance, not vibes. Optimization is being measured for the shortcuts it was always taking. The agent’s defining properties stopped being features to celebrate and became engineering problems to manage. That’s not a regression — it’s what maturity looks like.

Worth bookmarking

Share:
Suggest changes