On October 16, Charles Schwab's Andy Wurster described a number he did not give a precise meaning to. Tens and twenties. That was the count โ per week, perhaps per month โ of automated agents attempting to touch client money and finding the door locked. Schwab's solution was almost elegant in its bluntness: a read-only Model Context Protocol server. Agents can see balances. Agents can run research. Agents cannot move a dollar. Across town, JPMorgan drew a thicker line and simply blocked external agents from reaching account information at all.
There is no federal law governing what happens when an autonomous agent wires your rent to the wrong landlord. There is no safe harbour, no liability standard, no insurance mandate. Three bills sit in committee: Warner's AI AGENT Act, the Hawley-Murphy AI Agent Accountability Act, and the Great American AI Act. None has moved. The Department of Justice has declined to intervene. And so two of the largest custodians of American retail wealth did the only thing left to them โ they wrote the rules themselves, in code, and called it risk management.
That is what the legal economists call private ordering. I would call it something less flattering and more accurate: the financial system has decided that the absence of a liability framework is itself a reason to freeze the capability, and it has done so unilaterally while nobody was empowered to object.
The Technical Reality Behind the Read-Only Label
MCP is an open protocol Anthropic published in November 2024. By the middle of 2025 it had been adopted as a de facto standard for exposing tools and resources to language models. When Schwab says it deployed a "read-only MCP server," what it means in architecture terms is straightforward: the server exposes resources โ balance queries, statements, position data โ and restricted tools for research. It does not expose a transfer tool. There is no endpoint an agent can call that results in a redemption, a wire, or a trade.
Based on my audit experience with AMM bonding curves and flash loan surfaces, this is the correct first layer and a dangerously incomplete one. Read-only MCP stops the crudest attack: an agent directly invoking an API to move funds. It stops nothing else.
It does not stop indirect prompt injection. If an agent ingests a research PDF or a scraped webpage carrying an adversarial instruction, and that agent holds any writable tool anywhere in its toolset, the injected instruction becomes the user's intent as far as the model is concerned. Schwab's read-only server is irrelevant to what happens on the other side of that call.
It does not stop session hijacking. An agent holding a valid session token can bypass MCP entirely, call the underlying API directly, or replay captured requests. The MCP layer is a gateway, not a wall.
And most critically, it does not stop the scenario Wurster himself described: a customer handing their password to an external agent like Meta's Muse. That agent does not need MCP. It does not need an API. It opens a browser, logs in as the human, and trades. Read-only server access is a lock on a door the attacker is not using.
I have watched this pattern before. In 2020 I spent three weeks tearing apart AeroSwap's bonding curve before mainnet, and the vulnerability I found was not in the mathematics โ the formulas were sound โ it was in the withdrawal function's reentrancy exposure. The team had hardened the obvious surface and left the callback path open. Schwab has hardened the obvious surface. The callback path is a user with a password.
What They Are Actually Protecting
Here is the part the coverage missed entirely.
If a third-party agent can execute on a Schwab account, Schwab ceases to be the service provider and becomes the ledger. The customer relationship moves to Meta. The cross-sell disappears. The interface becomes someone else's interface. Wurster's Charley assistant exists precisely because Schwab understands this: Charley is not a product built to win a market, it is a defensive asset built to give users a substitute good enough that they do not defect to an external agent for the privilege of AI-driven account management.
This is not cynicism on my part, it is the standard incumbent playbook. Banks built their own mobile payments rather than surrender the payment rail to Alipay and WeChat Pay. The technical term for restricting agent permissions is permission scoping. The commercial term is customer touchpoint protection. Both are happening at once and only one is being said out loud.
And the asymmetry is total. Schwab and JPMorgan hold the account. Meta holds a model. Models are replaceable โ a user dissatisfied with Muse switches to Charley, or to a third-party agent that adapts to read-only MCP. Accounts are not replaceable. Moving a brokerage account means transferring positions, resetting automatic investments, reconstructing a credit history. The behavioural moat is measured in years, and the regulatory moat behind it โ SEC and FINRA registration, OCC and Fed supervision โ is statutory. No agent platform can route around a licence.
We have seen this exact film. Plaid spent 2020 and 2021 fighting banks over data access and lost on the terms that mattered, accepting paid interfaces and structured fees. Then Plaid's valuation went up anyway, because the underlying demand was rigid. Being blocked by an incumbent is not the same as being proven wrong.
The Contrarian Read: This Is Accelerating Agent Adoption, Not Delaying It
The conventional interpretation of the Schwab-JPMorgan news is that AI agents have been stopped at the gates of finance. I think that reading is backwards.
Look at the table. Retail brokerage account operations: low substitution, under ten percent, because the execution layer is fenced off. But research interpretation, asset allocation advice, tax optimisation prompts, transaction dispute explanation, compliance pre-screening โ high enhancement from day one, low regulatory friction, immediate deployability. Wealth advisory for sub-scale clients: twenty to forty percent substitution over two to five years. Customer support: above fifty percent inside twenty-four months.
The fence did not stop the agent. It redirected it into the layer where the addressable market was always larger and the compliance cost was always lower. Decision support is where most of the economic value of financial advice actually lives anyway. Execution is a commodity that the incumbent charges for.
The deeper lesson is about trust. A model that writes production code flawlessly is still not trusted to move money. Trust in agents is domain-scoped and it accrues incrementally through audit trails, certifications, insurance, and controlled pilots. General capability does not transfer. This is the single most important operational insight for anyone building in this space, and it cuts against the entire prevailing narrative that capability improvements compound into permission.
And there is a real risk hiding in the read-only solution. It creates a security theatre effect. Institutions point at the MCP permission boundary and say the risk is managed, while the actual threat surface โ users voluntarily surrendering credentials to external agents, browser automation, session replay, indirect injection โ sits entirely unaddressed. If a loss event occurs, the question will not be "why did you allow the agent" but "you knew the password-sharing scenario existed and you deployed nothing to detect it." That is a far worse position than having done nothing at all, because it establishes knowledge of the risk.
This is why I keep telling teams that in high-risk domains, capability restriction beats alignment every time. Schwab did not try to prove its models well-aligned. It removed their ability to cause a specific class of harm. That is the correct engineering instinct, arrived at by people who apparently do not read the alignment literature and do not need to.
The MCP adoption itself is the underreported story. A protocol that did not exist fourteen months ago is now the integration standard at a top-tier custodian. Open source won the agent infrastructure layer, and it won faster than anyone forecast. The corollary is that the protocol's security defaults now matter enormously โ and MCP currently ships no permission tiering, no audit logging, no intent binding. Expect a commercial "financial-grade MCP gateway" market to appear within a year, because institutions will pay for what the open protocol does not provide.
Meanwhile the true opportunity is unglamorous. Agent identity and delegated authority infrastructure. Cryptographically bound transaction intents. Tamper-evident audit logs that let an institution prove to a regulator that its agent read a balance and did nothing else. Responsibility insurance. OAuth for agents. RegTech that adapts one agent's behaviour to eleven different banks' private access rules. This is the layer institutions are compelled to buy, and it is being built right now by people who noticed that the read-only standard creates an audit obligation the read-only standard does not itself satisfy.
Europe will likely legislate first. The EU AI Act already classifies financial AI systems as high-risk, with transparency, logging, and human oversight obligations mandatory. If Brussels writes the agent liability rule before Washington does, the Brussels effect will drag American institutions into compliance regardless of what Congress never passes. Brussels regulates, then Washington follows. Ask anyone who has implemented GDPR.
The forward question is not whether agents will eventually move money. They will, because users want it and demand of that kind is rigid โ the Plaid precedent proves the market does not abandon companies whose value is real. The question is what has to exist before the fence comes down. My answer, from the audit trenches rather than the policy journals: an audit trail nobody can forge, an intent binding nobody can spoof, a liability allocation somebody will underwrite, and a detection layer that catches the customer who hands their password to a stranger. Schwab built the first wall and stopped there.
Tens and twenties. That is the sound of a boundary being defined by whoever got there first. The law will arrive eventually, years late, and ratify a standard it did not write โ a standard set by two institutions answering to no one, in a protocol that ships no defaults, over an interface that a determined user with a password can walk around entirely.