The Server Was Up. Its Security Policy Wasn’t.

How a startup initialization failure caused an AWS API MCP Server policy bypass—and what CVE-2026-16584 teaches us about secure AI agents and MCP security.