KDCube
← AI Industry News

Agentic Security Hits Black Hat as MCP Governance Consolidates

At Black Hat USA 2026, Snowflake pitched Cortex AI Gateway as a single MCP control plane governing agent access across Bedrock, Foundry, and ChatGPT, with Agent Identity now GA and data-exfiltration detection in preview. Meanwhile the finalized MCP 2026-07-28 spec adds Extensions, MCP Apps, and Tasks w...

Highlights

  • Snowflake used Black Hat USA 2026 to position Cortex AI Gateway as a centralized MCP gateway that governs how agents reach models, data, and tools across Bedrock, Azure AI Foundry, and ChatGPT — with Agent Identity now GA and Data Exfiltration Prevention in preview. (Snowflake)
  • The finalized MCP 2026-07-28 spec's real story isn't just statelessness: it adds an Extensions framework, ships MCP Apps (server-rendered UIs in sandboxed iframes), and moves Tasks to an extension. (MCP Blog)
  • MCP formally deprecates Roots, Sampling, and Logging under a new policy that keeps them working for at least twelve months — the first hard migration clock the protocol has set. (MCP Blog)
  • Microsoft's agent-framework python-1.13.0 (Jul 30) lands reusable session stores, a beta Foundry-hosting package, and Responses support — the Python SKU catching up to the dotnet runtime line. (GitHub)

Key Signals

  1. Cortex AI Gateway makes MCP the enterprise choke point — Black Hat USA 2026, briefings Aug 5-6

    Snowflake is treating the Model Context Protocol as the place to enforce policy, routing first- and third-party agent traffic through one governed gateway and pairing it with Agent Identity (GA), native AI Security Posture Management in the Trust Center, and a preview data-exfiltration detector that flags mass downloads and sensitive fetches by agents. For operators, that reframes MCP from a connectivity spec into a control plane. (Snowflake, Black Hat)

  2. MCP's extension era changes what you build against — spec dated 2026-07-28

    Beyond dropping session IDs, the spec splits capabilities into reverse-DNS-scoped extensions that version independently, delivers UI through MCP Apps as sandboxed iframes speaking the same JSON-RPC, and returns Tasks as handles for long-running work. The upside is composability; the catch is a new UI attack surface to sandbox and a deprecation clock — Roots, Sampling, and Logging keep working for ~12 months, then may go. (MCP Blog, MCP Blog)

  3. The runtime consolidation keeps grinding forward — python-1.13.0, Jul 30 2026

    With dotnet-1.17.0 (Aug 4) tightening declarative-workflow error handling, the Python line adds reusable session stores, expanded telemetry, stronger workflow replay/approvals, and a beta agent-framework-foundry-hosting package — signaling Microsoft wants both SKUs at parity for supported, hosted deployment. (GitHub)

Why It Matters / What To Watch

  1. Governance is consolidating at the gateway/identity layer, not the app.
    • Test whether Cortex AI Gateway's cross-ecosystem coverage (Bedrock, Foundry, ChatGPT) actually spans your stack before betting policy enforcement on it. (Snowflake)
    • Treat agent identity and exfiltration detection as GA-grade controls now, not roadmap items — Black Hat's Aug 5-6 briefings will pressure-test exactly these claims. (Snowflake, Black Hat)
  2. MCP integrations now carry a maintenance clock and a new UI surface.
    • Inventory any dependence on Roots, Sampling, or Logging and plan migration inside the ~12-month window. (MCP Blog)
    • If you adopt MCP Apps, budget for iframe sandbox review and JSON-RPC boundary hardening — server-rendered UI is a fresh injection vector. (MCP Blog)
  3. Runtime choice increasingly means picking a supported SKU, not a library.
    • Watch whether python-1.13.0's Foundry-hosting beta and session stores reach GA parity with the dotnet line before you commit a language. (GitHub)

Quick Links