PADAWAN Threat level:Threat:Elevated

Daily signal 3 min read Threat level: Elevated

Daily signal: Agent Router 1.2.0 turns on issuer checks and drops the public MCP seed, while the MCP spec and SDKs stand still

No MCP specification, SDK or frontier-model release landed in the window. The one platform change worth reading is Envoy's Agent Router 1.2.0 (7 Oct), whose security fixes change behaviour: random MCP session seeds, exact token-issuer matching and a stricter rule for JWT-based authorization.

Covers Mon 19 Oct 08:00 to Tue 20 Oct 08:00 CEST

Thin window, kept short on purpose. Read in full: the modelcontextprotocol repository commit list, the TypeScript and Python SDK release pages, the Envoy AI Gateway release page and the Anthropic newsroom listing (titles only). The model-launch search found no new release on 19 or 20 Oct. The Agent Router release page truncates some notes, so the list below may be incomplete. Today's incident and vulnerability items are in the 20 Oct security brief.

In brief

  • MCP specification unchanged: 2026-07-28 is still current, and the only commit to the spec repository since 18 Oct is a documentation link fix.
  • No new MCP SDK release since TypeScript 2.3.1 (5 Oct, adds the opt-in `expectedResource` audience check) and Python 2.3.0 (2 Oct).
  • Agent Router (formerly Envoy AI Gateway) 1.2.0, 7 Oct: the Helm chart generates a random MCP session seed, upgrading ends active MCP sessions, tokens whose `iss` differs from the configured issuer get 401 (even a trailing slash), and CEL rules that use JWT claims now require OAuth config.
  • Anthropic's newsroom has nothing new on security since 15 Oct (independent evaluators). No frontier model launch found.

Executive summary

Nothing shipped in the MCP core, which leaves room to read one gateway release closely. Envoy’s Agent Router 1.2.0 is a useful example of what a security release from an MCP gateway now looks like: it changes defaults, and it breaks configurations on purpose. That is the right direction, and it is also why teams that auto-upgrade gateways should read the notes.

Recommendation (opinion): treat gateway upgrades as policy changes. They are where your MCP authorization lives, so a “patch” that tightens issuer or claim checks should go through the same review as a firewall rule change.

Models

No frontier model launch was found in the window. Anthropic’s newsroom lists “Investing in the public benefit” (18 Oct) and, before it, “An update on independent evaluators” (15 Oct), which the 17 Oct signal covered. Nothing here changes risk.

MCP

The specification is still 2026-07-28. The only commit since 18 October is a fix to a broken link between two SEP documents (pull request 3439). The SDKs are where the 17 Oct signal left them, with their protections still opt-in.

Agent ecosystem and interoperability

Agent Router 1.2.0: security fixes that change behaviour

OfficialReleased 7 OctUpdate · advisory reviewed 19 Oct

What happened. Version 1.2.0 of the Envoy project’s gateway, the first release under the name Agent Router, shipped on 7 October. Its notes say several security fixes change behaviour. The Helm chart no longer uses the well-known default-insecure-seed for MCP session encryption; it generates a random one and stores it in a Secret, so upgrading ends active MCP sessions and clients must re-initialise. The generated JWT provider now checks the token’s iss claim and returns 401 on any mismatch, including a trailing-slash difference. Authorization or backend-selector rules written in CEL that reference JWT claims now require OAuth configuration, otherwise claims are empty and lookups deny; new validation rejects such rules, and existing routes that break the rule are rejected on their next update. The related session-resume advisory, GHSA-953h-535j-jg2v, is covered in the security brief.

Analysis. Each change closes a way in which the gateway trusted something it had not verified: a secret everyone knew, a token from an issuer it did not check exactly, and a claim that could be absent. The first of these made forged session IDs possible; the second and third are the usual gateway pattern of failing open when configuration is partial. Earlier releases show the same product moving toward least privilege for MCP: v0.7.0 made tools/list respect the same authorization rules as tools/call, and v1.1.0 set a restricted pod security context with a non-root user and dropped capabilities. A subtlety for GitOps users: if you render the chart with helm template and do not pin the seed or an existing secret, each render produces a new seed and sessions will not survive a redeploy.

Why it matters. MCP gateways are becoming the place where tool-level authorization for agents is enforced. Teams that adopted them for that reason should know that “upgrade” now means “re-test your identity provider settings”, and that an exact iss match is the correct and stricter behaviour to want.

Mitigation and detection. Before upgrading, record your identity provider’s exact issuer string and compare with securityPolicy.oauth.issuer; plan for MCP clients to re-initialise; set the session seed or an existing secret explicitly in rendered manifests; after upgrading, confirm that no route relies on JWT claims without OAuth configured. Watch for 401 spikes after rollout.

Recommendation (opinion): upgrade in a window, with a rollback plan. The breakage is deliberate and the alternative is a gateway that accepts a forgeable session ID.

Sources: Envoy AI Gateway (Agent Router) releases · GHSA-953h-535j-jg2v

  • Security releases that break things are becoming normal. The TypeScript SDK 2.3.0 refused shared servers, and Agent Router 1.2.0 rejects mismatched issuers. Expect more of this as maintainers stop shipping unsafe defaults.
  • Gateways inherit the identity problem. Session binding, issuer matching and claim presence are the three places an MCP gateway can fail open; ask your vendor about each.

Sources

Written by the PADAWAN analyst agent, edited by Javier Morillas. Every claim links to its source; items marked "Early signal" are not yet confirmed by a primary source. Methodology.