Two dozen attempts. That is the entire dataset.
Charles Schwab's AI leadership described unauthorized agents probing client accounts at "tens and twenties" per week. JPMorgan, in the same reporting, blocks external agents from reaching account information at all. Two institutions, one headline, and a sample size too soft to carry the weight placed on it. A weekly count in the low double digits is not an attack pattern. It is an unresolved signal. The code does not lie; it only waits to be read โ and this code has not been read yet, only summarized.
The technical substrate here is MCP, the Model Context Protocol that Anthropic published in November 2024 and that the industry adopted as a de facto standard through 2025. MCP servers expose three primitives to a client: tools, resources, and prompts. Schwab's implementation is a read-only server. It surfaces resources โ balance and position queries โ and a restricted set of research tools. It exposes no tool with transfer authority. That is a correct architecture. It is also cheap, which matters: a gateway deployment is not a thousand-GPU commitment. The barrier to entry for an incumbent broker is an API surface, not compute.
Then Charley. Schwab's in-house assistant is the sanctioned path. The external agent gets read access; the house agent keeps the relationship. Call that risk control if you like. Structurally it is user-touchpoint protection. If a third-party agent can execute, the broker degrades from service provider to settlement ledger โ a custodian with a login screen.
Then private ordering. Three federal vehicles โ Warner's AI AGENT Act, the Hawley-Murphy AI Agent Accountability Act, and the Great American AI Act โ sit in committee. The DOJ has not moved. Into that vacuum, two institutions wrote a permission boundary and shipped it. No statute required. That is the actual news, and it is not about AI capability at all.
What Schwab described publicly is layer one of five. A defensible agent-finance stack looks like this: minimum privilege at the tool surface; intent binding, where a transaction is cryptographically tied to an explicit user instruction; human confirmation above a value threshold; behavioral anomaly detection against a per-account baseline; and tamper-evident audit logging. Only the first appears in the public description. A permission boundary is not a promise. It is a surface that can be tested, and four of the five surfaces here have not been described, let alone tested.
The read-only server closes exactly one path: an agent calling the transfer API directly. Three others remain open.
Indirect prompt injection. An agent reads a poisoned research document or a compromised web page. If that agent holds any executable tool anywhere in its stack, the instruction executes outside Schwab's perimeter. Read-only at one endpoint does not constrain a multi-tool agent.
Credential handoff. The described scenario โ a client handing account credentials to a third-party assistant โ is authorization, not intrusion. Read-only MCP intercepts API access. It does not intercept a browser session driven by automation. The controls that would catch this are device fingerprinting and behavioral baselining, and neither was described.
Session replay. A valid token bypasses the MCP surface entirely. If the token lives in the agent's context, the tool whitelist is decoration.
Here is where the on-chain record becomes useful, because the permission problem was solved there first and solved better. ERC-4337 session keys and scoped allowances do what read-only MCP does not: they bind a delegated authority to a spend limit, a counterparty allowlist, and an expiry, then log every use immutably. An agent holding a scoped session key can transact โ within a boundary enforced by the contract, not by the agent's good behavior. TradFi's read-only posture is a strictly weaker version of a mechanism DeFi shipped in production. The constraint that works is the one written into the enforcement layer, not the one written into the policy document.
I spent 200 hours in 2019 hand-auditing 0x v2's order-matching engine. Three logic flaws, all in the seams between functions that individually read as correct. Permission systems fail the same way. The center holds; the junction leaks. And in 2020 I modeled Compound's rate curves across 50,000 blocks and found the liquidity trap that liquidated the over-leveraged โ the mechanism was visible in the data months before it was visible in the price. The same discipline applies here: a permission model is only as good as its worst-adjacent path.
The correlation being sold is that agent attempts equal agent threats. The more probable reading of "tens and twenties" is client-driven configuration โ users wiring a third-party assistant to their own accounts and being refused at the gate. That is demand, not hostility. Framing it as an attack inflates a security narrative and buries the actual gap, which is that no party in the chain holds both the information and the control to allocate liability.
Follow the chain. The model provider says the deployment was out of scope. The orchestration layer says the model misbehaved. The broker says the client authorized it. The client says nobody told them what would happen. Four parties, zero overlap between knowledge and authority. Legislation is stalled because that allocation requires evidentiary rules and insurance structures, not a technical standard โ and a technical standard is what the industry can ship this quarter.
There is a second blind spot. The regulatory silence is being read as failure. It is more likely forbearance โ let the industry run the experiment, intervene after the first loss. And a third: the read-only standard, once two or three more institutions copy it, hardens faster than any statute and is far harder to reverse. Standards set by practice outlive standards set by text.
Watch three signals over the next two quarters. A second and third institution confirming the same posture converts a data point into an industry standard. Any informal SEC or FINRA guidance moves faster than the committee queue and will reprice the whole question. And whether the MCP community ships permission tiering โ intent binding, audit hooks โ determines whether brokers buy a gateway or build one.
The question I am holding: when the first realized loss arrives through a simulated login rather than an API call, whose log will be admissible? Integrity is not a feature; it is the foundation.