Two custodians. One week. A double-digit count of blocked agent requests. That is the entire evidentiary record on which a governance regime is now being assembled.
On October 16, Charles Schwab and JPMorgan Chase each confirmed โ in separate statements, with no public evidence of coordination โ that they had refused to let external AI agents move customer money. Schwab's mechanism is a read-only Model Context Protocol server. JPMorgan's posture is described more broadly, as blocking external agents from reaching account information at all. The disclosed volume of intercepted attempts is "tens and twenties" per week.
Not thousands. Not a documented loss event. Not one confirmed fraudulent transfer. A weekly count in the low double digits, against a customer base measured in millions.
I have spent enough time inside disclosure review to know that a number without a denominator is a rhetorical device, not a metric. Tens and twenties of what, against how many attempted connections, split how between customer-initiated authorizations and adversarial probes? That decomposition decides whether this is a risk-control event or a security event. The public record does not contain it.
Data does not negotiate; it only reveals. What this data reveals is thinner than the coverage suggests โ and more consequential than the coverage admits.
The protocol underneath the announcement
Model Context Protocol was published by Anthropic in November 2024 and, through 2025, became the de facto integration standard for agents reaching external systems. Its architecture is unremarkable and that is precisely why institutions adopted it: a server exposes three primitive categories โ tools the model can invoke, resources the model can read, and prompts the model can be handed. Permission design therefore reduces to a question of surface area. Which primitives does the server publish, and what can be executed from them?
Schwab's answer is narrow by construction. The server publishes resources for balance and account queries, and a restricted set of research-oriented tools. It publishes no execution tool capable of initiating a transfer. This is the cheapest available permission-narrowing technique in the MCP specification. It requires no new cryptography, no new identity layer, no legal instrument. A configuration change and an access-control policy.
That it works at all is a small but genuine victory for open protocols. A standard released in late 2024 is now the integration layer for two of the largest retail brokerages in the United States. Whatever else is true, no closed vendor stack achieved that.
The regulatory backdrop explains the urgency. There is no federal statute governing agent-initiated financial transactions. Three bills sit stalled in committee: Senator Warner's AI AGENT Act, the Hawley-Murphy AI Agent Accountability Act, and the Great American AI Act. The Department of Justice has signaled it will not intervene. Into that vacuum, Schwab's Rick Wurster offered the sentence that should anchor every serious reading of this story: we cannot control it, the customer cannot control it, and if something goes wrong, who is liable?
That is not a rhetorical flourish. It is an accurate description of a liability chain with four links and no owner. Legal economists call the response private ordering โ private parties constructing enforceable order through contract, configuration, and organizational rule where statute is absent. The term is used correctly here. It is also used without a single contract, term of service, or configuration artifact attached as evidence. The framework is descriptive. It is not yet verifiable.
What a read-only server actually constrains
Strip the announcement to its control surface. A read-only MCP server prevents an agent from calling an execution endpoint directly, through the sanctioned integration path, with credentials issued through that path. Within that boundary it is effective and it is cheap.
It is also a static control applied to a dynamic adversary. I learned that distinction at cost. In 2021 I ran static analysis on a generative art minting contract with a fifty-thousand-dollar audit budget and a clean report. Within hours of launch, a minting exploit drained two million dollars from the treasury. The code I reviewed was correct. The behavior I did not model was not. I spent the following three months reconstructing the attacker's transaction history and concluded that my failure was not a missed line โ it was a category error about what static review covers.
A read-only gateway is the same category of instrument. It constrains a declared interface. It does not constrain behavior outside that interface, and agent systems generate behavior outside declared interfaces by design.
Three surfaces the control does not cover
First, indirect prompt injection. An agent reads a research document, a web page, an email, a filing. The content carries instructions. If that agent holds any execution capability anywhere in its tool graph โ even a benign one โ the injected instruction can be chained toward an action the user never authorized. Schwab's read-only server removes one execution path. It does not remove the agent's other paths, and it does not remove the agent.
Second, credential handoff. Wurster's own described scenario is a customer giving their password to a third-party assistant. That is not an intrusion. It is a voluntary delegation of authentication material, executed outside the MCP channel entirely. Read-only MCP does not touch it. It cannot. The constraint lives at the API layer; the risk lives at the authorization layer.
This is the central forensic finding in the disclosure: the control and the threat occupy different layers, and the control is being presented as coverage of the threat. A firm that publishes a read-only integration and simultaneously acknowledges that customers hand passwords to external agents has described a gap and called it a boundary.
Third, session and browser automation. An agent holding a valid session token, or driving a headless browser against the retail web interface, never touches the MCP server. The firm's declared control surface is bypassed without being defeated. Detection here requires device fingerprinting, behavioral baselines, and transaction anomaly scoring โ none of which appear in the disclosure.
The decomposition problem
The interception count is the only quantitative claim in the story, and it is uninterpretable as published. If the bulk of those weekly attempts are customers deliberately wiring a third-party assistant to their accounts, the event is a product-demand signal dressed as a security statistic. If the bulk are automated probes, it is an early-stage attack campaign. The two readings imply opposite strategic responses: build a delegated-authority product, or build a detection stack.
A control that cannot distinguish authorized from unauthorized attempts is not measuring what it claims to measure. It is counting traffic.
Four parties, no owner
Wurster's question โ who is liable โ decomposes into four positions, each holding partial information and partial control, and none holding both.
The model provider trains on general data, does not target financial execution, and will argue misuse. The agent orchestrator assembles the tool graph and will argue model defect. The institution controls the account and will argue the customer authorized the agent. The customer will argue they could not foresee the outcome. Every link is defensible. That is the problem: a liability chain in which every party has a valid defense is a chain that allocates nothing.
Legislation does not solve this by writing better technical standards. It solves it by assigning burdens of proof and mandating insurance. Neither exists. Which is why the read-only posture is best read not as a permanent architecture but as a holding position โ a way of deferring the liability question by removing the act that would trigger it.
Touchpoint protection, not risk management
The disclosed motive is risk. The structural motive is distribution.
If a third-party agent can execute against an account, the broker degrades from service provider to back-end ledger. The customer relationship, the interface, the cross-sell, and the data advantage all migrate to the agent layer. Schwab's Charley assistant is not an attempt to win a market. It is a defensive product: a sufficiently usable substitute that keeps the customer inside the firm's interface rather than surrendering the interaction to an external orchestrator.
This is the same institutional instinct that produced PayPal's stablecoin strategy โ become the party that writes the rule rather than the party that waits to receive it. Issuing a regulated dollar token was never primarily a product decision; it was a positioning decision about who sits at the table when the rule is drafted. A brokerage publishing its own MCP permission policy is doing the identical thing at the account layer.
The commercial consequence is asymmetric and immediate. Any company whose product promise is agentic financial execution โ automatic bill payment, rebalancing, spending control โ has had its core function reclassified as unavailable. What remains is aggregation and advice, which is a materially smaller business. The closest precedent is the aggregator-versus-bank dispute over data access, which ended with the aggregator paying for access on the banks' terms. The pattern is not new. The domain is.
The moat is a license, not a model
Model capability is substitutable. Account relationships are not. A customer blocked from using one assistant can switch to another, or to the incumbent's assistant, in an afternoon. A customer changing broker transfers positions, resets automatic investment schedules, and rebuilds a credit relationship measured in years.
That asymmetry decides the negotiation. Brokerages operate under securities and banking supervision; no agent platform can route around a charter. The license is statutory, the switching cost is behavioral, and the model is replaceable. In any scenario requiring the movement of money, the agent platform is the weaker party โ a fact that the prevailing narrative about AI restructuring financial distribution has consistently gotten backwards.
I documented the same inversion in 2025, auditing custody arrangements behind the spot ETF complex. Eighty percent of providers were running on legacy banking infrastructure with out-of-date security patches, inside a product marketed as decentralized exposure. Twelve specific compliance vulnerabilities, written up, distributed, ignored by the industry, and subsequently adopted as required reading by institutional risk officers. The lesson generalizes: the marketing layer and the control surface are almost never the same object, and the control surface is where the accountability lives.
What the bulls got right
The bearish reading โ agents blocked, therefore agents delayed โ is too simple, and the sophisticated version of the bull case survives the disclosure intact.
First, restricting agents to reading and calculating accelerates penetration rather than retarding it. The advisory layer is where the volume is: research synthesis, allocation proposals, tax-loss identification, statement reconciliation, compliance pre-screening. These functions carry low liability exposure, high perceived value, and no execution risk. Institutions will open that layer quickly because opening it costs them nothing and retains the customer. The execution layer stays closed. The result is that agents enter the financial stack through the door marked decision support and occupy it thoroughly, while the door marked settlement stays bolted. Total agent penetration rises. The composition of that penetration changes.
Second, capability restriction before alignment is the correct engineering order in high-risk domains. The industry's default instinct is to improve alignment until the model can be trusted with money. The institutions did the opposite: bound the capability so that trust becomes unnecessary. For a domain where a single erroneous transfer is irreversible and reputationally terminal, that is not conservatism. It is the only defensible sequence. Safety research would do well to internalize it: in high-consequence settings, a hard capability boundary outperforms a probabilistic alignment guarantee every time the guarantee is wrong.
Third, the regulatory silence is plausibly deliberate rather than negligent. Legislatures historically codify after industry practice stabilizes, not before; the intermediary liability framework that governed the early internet was itself an act of calculated forbearance. Reading the absence of statute as failure misreads the sequencing. Three bills in committee is not three bills abandoned. It is three bills waiting for a record to legislate against.
And the aggregator precedent cuts both ways. Being denied access did not destroy the aggregator's value. The acquisition that would have consolidated it was blocked on antitrust grounds; the company then raised at a valuation more than double the terminated price. Access restriction and commercial death are not the same outcome. A party whose value is proven rigid tends to survive the party that gates it.
What to watch, and the question that will be asked under oath
Two control strengths were disclosed and one headline was written. Schwab grants read-only access. JPMorgan reportedly blocks information access outright. Those are different postures with different technical meanings, and the coverage has flattened them into a single industry stance. Whether a genuine standard is forming or whether each firm is improvising depends on facts not yet public: whether other custodians coordinate, whether any firm offers tiered execution โ transaction limits, payee allowlists, second-factor human confirmation โ and whether the protocol community builds enterprise security extensions or leaves that space to commercial gateway vendors.
My expectation is that the read-only default propagates beyond finance within eighteen months, to medical record access, legal document retrieval, and government filing systems, because it is cheap, defensible, and rhetorically unassailable. The binding constraint on agent commercialization will not be model capability. It will be delegated authority infrastructure: agent identity, cryptographically bound transaction intent, immutable audit logging, and liability insurance priced against both.
The question that will be asked under oath after the first real loss is not whether the gateway was read-only. It is whose log will be produced in court. A firm that cannot reconstruct, per attempt, whether an agent was authorized, what it touched, and what it was refused, has not implemented a control. It has implemented a press release with a configuration file attached.
Data does not negotiate; it only reveals. Right now it reveals a weekly count in the low double digits and no denominator. That is not a control failure. It is an accounting failure โ and accounting failures are the ones that surface last, when the losses are already booked.