Gas fees don't lie. People do. Banks, it turns out, do neither — they simply close the door and call it policy.
On October 16, Charles Schwab confirmed something it had no obligation to confirm. A handful of its customers had handed their brokerage credentials to third-party AI agents, and something in the pipeline had stopped the transfer. Not a regulator. Not a court. A permission bit. "Tens and twenties" of attempts, per the firm's own characterization — a number so small it doesn't read like a security incident. It reads like a stress test of a system most people didn't know was being tested.
I've spent the last four years auditing contracts that were beautiful and broken, and watching teams discover — usually after the money was gone — that elegant architecture means nothing when the execution layer is held by someone else. What happened at Schwab, and reportedly at JPMorgan, is the same story with a different syntax. The difference is that this time the rot isn't in the code. It's in the absence of law, and the substitution of engineering for jurisprudence is happening in real time, at the exact layer where capital moves.
Minted nothing, promised everything — that's become the default posture of the agent economy in 2025. And the institutions just answered with a read-only server.
The Permission Model Nobody Wants to Audit
Understand what a "read-only MCP server" actually is before you decide whether to be impressed.
The Model Context Protocol was published in November 2024 and became the de facto standard for connecting language models to external systems within roughly nine months — a timeline that should tell you something about how starved the ecosystem was for a shared interface. Architecturally, MCP exposes three primitives from a server: tools, resources, and prompts. A tool is an action. A resource is a read. A prompt is a template.
When Schwab says it runs a read-only MCP server, the translation is mechanical: it exposes resources — balances, positions, transaction history — plus a constrained set of research-oriented tools. It exposes no tool capable of initiating a transfer. Not a disabled tool. Not a tool behind a flag. The tool does not exist on the endpoint.
That's a real defense. It's also the cheapest possible defense, and it is the first of five layers you would need to actually secure an agent against a financial account.
Here's what it does not block. Indirect prompt injection: your agent reads a research note, a webpage, a PDF an adversary seeded with instructions, and those instructions redirect every subsequent tool call. If the agent holds any tool in any environment capable of an outbound side effect — a browser, an email client, a second financial account — the read-only constraint at Schwab is irrelevant to the attack. Credential custody: the customer who hands their password to an external agent has already routed around the MCP server entirely. The agent authenticates to the web interface like a human, with a headless browser and a plausible device fingerprint, and Schwab's read-only API policy never gets a vote. Session token hijacking: an agent holding a valid session cookie can replay requests against internal endpoints, and the MCP layer's tool whitelist governs exactly nothing.
None of those three attack surfaces appear in the reporting. That's not a criticism of the reporting. It's a criticism of the framing. The industry is deploying layer one of five and presenting it as closure.
I built a small instrumentation harness in 2020 to detect front-running patterns across failed transactions in the Uniswap mempool — 500-plus failed txs, Python, nothing clever, just patience. The lesson from that exercise was not that the protocol was insecure. It was that the protocol did exactly what it was told, and the people using it had no model of what "told" meant. Same failure mode here. Customers told their agent to "manage my portfolio." The agent heard a mandate. The broker heard an unauthenticated instruction from a non-human principal with no legal standing.
That gap is not a technical defect. It's an ontological one.
Who Answers the Phone When the Wire Clears
The quote that matters from this whole affair is the one attributed to a Schwab executive: we can't control it, the customer can't control it, and when something breaks, who is responsible?
Unpack that sentence. It names four parties and assigns accountability to none.
The model provider trained on general data, never scoped to financial advice, and will argue misuse. The orchestration layer that packaged the model into an agent product will argue model defect. The institution will argue user authorization. The customer will argue they had no idea what would happen. Every party's claim is true from where they stand, and every party's claim is self-serving from where the others stand. No participant in the chain holds both the information and the control to prevent the outcome. That is not a liability problem that gets fixed by a better contract. That is a liability problem that requires a statutory safe harbor and a mandatory insurance market, and neither exists.
So the institutions did the only thing that ships. They restricted capability instead of betting on alignment.
I want to be precise about why that's the right call and why it's also a deferral. In safety research there's a live argument about whether to constrain what a system can do or to make the system want to do the right thing. Alignment is hard, probabilistic, and unverifiable from outside. Capability restriction is deterministic: if the tool isn't there, the call fails. At a brokerage, sitting on top of trillions in customer assets and a trust obligation that predates the term "large language model," the answer picks itself. You do not let the agent move money because you cannot yet let it move money responsibly, and the distinction between those two sentences is the whole ballgame.
But naming it a deferral isn't cynicism. It's accounting. Schwab is waiting for law. The read-only server is a holding pattern, not a terminal state. The moment a safe harbor, a liability cap, or a mandatory insurance regime gives the firm somewhere to put the risk, executable permission comes back — because customer demand for it is real and unkillable. Ask anyone with a brokerage account whether they'd like an agent that rebalances quarterly and pays bills from dividends. The answer is yes. It was always yes.
The Plaid Precedent Is the Only Honest Analogy
If you want to see how this ends, look at how it went the last time an API access war broke out between account holders and account custodians.
The parallel is exact and the record is public. Plaid built a business on letting fintech apps read and act on customer bank accounts. Banks objected — not to the customer's right to their own data, but to the mechanism and to who bore the security burden. That fight landed in 2020 with Visa's $5.3 billion acquisition attempt, blocked on antitrust grounds a year later, and resolved in the opposite direction from where most people predicted: Plaid didn't die. It signed bilateral agreements with the banks, restructured access as a paid, audited, bank-approved rail, and raised at a reported $13.4 billion valuation in 2021.
The lesson isn't "regulators protect incumbents." The lesson is that an access restriction is a pricing negotiation conducted with different vocabulary. The custodian's objection was never that the data wasn't the customer's. It was that the custodian carries the reputational and legal cost of a breach while the aggregator captures the margin. Swap "data" for "execution" and "aggregator" for "agent platform" and you have, nearly verbatim, the Schwab position in October 2025.
Which means the read-only constraint is not a wall. It's an opening offer.
The counter-offer will look like tiered permission. Read-only for everything. Rebalance-only with a whitelist of instruments. Transfers capped at a dollar threshold and rate-limited per day. Payments locked to verified payees established more than thirty days prior. Each tier carrying an audit requirement, an insurance requirement, and a fee. That's how bank data access was priced and that's how agent execution will be priced. The current state — Schwab offering read-only, JPMorgan reportedly blocking external agent access to account information altogether — isn't a unified policy. It's the pre-negotiation posture. Two firms, different restrictions, neither of them final, both establishing that the custodian sets the terms.
And here's the part the agent companies are learning the hard way: the model layer is substitutable and the account layer is not. Customers churn brokers once a decade if that. They churn models in an afternoon. Meta can ship a compelling agent and OpenAI can ship a better one, and it changes nothing about who holds the credentials. Capability does not convert into custody. The moat isn't in the weights. It's in the SEC registration.
The Bull Case Nobody Is Making
Here's the contrarian read, and I'll give it its full weight because it deserves it.
Restricting agents to the analysis layer doesn't slow adoption in financial services. It accelerates it — in a form the frontier labs have spent eighteen months underestimating. Read-only access is cheap to grant, cheap to audit, and cheap to unwind. Research summarization, position explanation, tax-lot optimization prompts, earnings-note disambiguation, anomaly flagging on expense categories — every one of those is a genuine 20-40% productivity return for a retail investor or an advisor's back office, and none of them require a single executable tool. The Schwab team shipped an MCP server inside a year of the protocol's existence. That's not a bank being slow. That's a bank moving faster than most startups in the same window.
There's a second point the bears miss. JPMorgan's public position is stronger than Schwab's — blocking external agents from account information, if reporting holds, is more aggressive than a read-only tier. That's evidence against a coordinated industry standard. Two major custodians landing on different restrictions means no single private rulebook is locked in yet, which means there's still space for an interoperability requirement before the standard crystallizes by default. Standards that form through shared technical practice harden faster than law and reverse slower. Right now the practice is divergent. That window will not stay open long.
But the bear case is the one I actually believe, and it's already visible.
A read-only standard that's already been adopted by the largest retail brokerage in the United States has a natural portability problem. Medical records: read access versus prescribing. Legal practice: document review versus execution of filings. Government services: query versus submission. The same institutional logic that produced a read-only financial agent produces a read-only everything agent, and it does so because it is genuinely the responsible default in each case. That's what makes it dangerous. Restrictions adopted for good reasons propagate for structural reasons, and nobody has to coordinate for it to become the ceiling on an entire product category rather than a floor on its first version.
I audited a decentralized exchange in Prague last spring under the MiCA transition, and I came away with an unexpected reading. The developers I spoke with treated compliance obligations as design constraints — annoying, non-negotiable, structurally formative — and built to them the way you build to a gas limit. That is not what the private-ordering literature predicts. It predicts avoidance, loopholes, jurisdictional arbitrage. These teams just absorbed the constraint and shipped something compliant and dumber than what they could have built. The regulatory framework did not kill their product. It gave their product a ceiling it will never see over.
The AI Agent Act and the AI Agent Accountability Act, the Warner proposal and the Hawley-Murphy companion, are sitting in committee. The Department of Justice has declined to intervene. The absence of a rule is being filled by a permission bit and the permission bit ships monthly. Code is truth. Intent is fiction. The read-only wrapper is, for now, the only sentence of law that actually executes at the transaction layer, and it wasn't written by anyone accountable to the people it governs.
What none of the reporting covers — and it's the most practical question in the whole episode — is what firms will do about the customer who hands their password to an agent anyway. Not through MCP. Through a headless browser with a plausible fingerprint and a residential proxy and a session that looks like a human's. Schwab's read-only policy governs the front door. The customer with a password is walking through the garage.
That's the finding that keeps me cold about this whole class of deployment. Mechanical restrictions are excellent at controlling what systems do when systems behave the way you expect. They are worthless against the class of human decisions that motivated the restriction in the first place — the ones where someone decides their agent is more capable than it is, and hands it the keys, and there's no MCP handshake to catch them doing it.
Two Years, Then the Blobs Saturate
I've written this prediction down before and I'll write it down again, because the mechanism matters more than the date.
Every access tier that opens, opens without a fee for the first eighteen months because the institution is buying adoption data with free capacity. Then it saturates, the capacity gets scarce, the fee appears, and the tiers compress. I watched this happen on the data-availability layer when blobs went live post-Dencun: capacity that was effectively free because nobody had built against it became a bidding war the moment every rollup started posting to it. Gas doubled from the floor up. That was predictable from the supply schedule alone, which nobody read.
The same shape is coming to agent execution. The first tier — read-only — is free because the institution wants call volume. The second tier — constrained execution, whitelists, caps — will launch free to establish behavioral baselines. The third tier, whenever it lands, is the one with a price attached, and by then the baselines are established and the caps are calibrated and the auditing vendors are integrated and the pricing power has consolidated into whoever wrote the gate. That's an eighteen to thirty-six month arc, and the current news cycle is the opening of the first tier.
The bills in committee will not determine the shape of that arc. They will ratify it, probably in 2027, probably by referencing audit standards the industry already wrote in 2026, probably with a safe harbor that the incumbents drafted. That's not a prediction of malice. It's a description of how technical capacity that exists before legislation gets folded into legislation as the baseline of what's considered feasible. Regulatory capture is rarely adversarial. It's usually just competent people writing against the systems they know.
So the ledger, as it always does, keeps score on the people who moved slowest.
Soulbound identity credentials have been "three years away" for the same duration because nobody wants their credit history permanently public and non-transferable, and that intuition — that some permissions are too permanent to be worth the utility — is the correct primitive the industry keeps rediscovering. A read-only agent is the same intuition with a server config. Customers don't want their money moved by something whose failure mode they cannot enumerate. Firms don't want to underwrite an action whose responsibility chain has four empty chairs. Neither side is wrong. They're both responding correctly to the same missing artifact, which is a legal infrastructure that distributes liability across model provider, orchestrator, custodian, and customer in proportions that can be insured against.
Until that infrastructure exists, the permission bit is the law. It's a bad constitution — unaccountable, unilateral, and enforced at the layer where mistakes are irreversible — and it's the only one anyone is actually willing to enforce right now. Which is a strange sentence to write about two of the largest financial institutions on earth, until you remember that the alternative is trusting four parties with irreconcilable and contradictory accounts to somehow agree, in real time, on what the money should do. There's no version of that agreement that gets signed with gas in the tank.
The question worth sitting with is not whether Schwab lifts the restriction. It will. The question is what the audit record looks like when it does — and whether, on the day an agent moves a customer's money wrong, anyone can prove which of those four chairs was occupied.