Somewhere between several thousand and roughly fifteen thousand MCP servers answered on the open internet during the 2025 exposure scans. The share sitting behind consumer-grade tunnels was a fraction of one percent. I have carried those two numbers around for months, because they describe a system built to be reachable and never built to be governed โ and because almost nobody quoting them seems to notice the second half of the sentence.
Last week a document reached me titled Your Home Agent's First Autonomy Test: The Scenarios Nobody Has Stress-Tested. It describes a 2026 in which a Google home endpoint ships on September 16, a Meta shopping agent clears checkout through one-time virtual cards four days later, and Amazon blocks the entire arrangement on September 20. I checked the dates. I checked the products. None of them verify. And the document remains the most useful thing I have read on home agents this quarter โ for reasons its author almost certainly did not intend.
The document has three load-bearing claims: that platforms hold an effective veto over agent execution, that human approval cards are the current workaround for that veto, and that identity verification is fragmented across ecosystems. Those three claims are correct. The evidentiary scaffolding around them is not.
The verification split is worth stating plainly, because it determines how much weight anything downstream deserves. The "D25 cycle" used to periodize the timeline has no public definition and is not an industry term โ it is the signature move of generated content, a fabricated epoch name deployed to manufacture authority. The Apple identity layer is described as running on "Secure Exclaves." Secure Enclave is real. Exclaves is not a corresponding concept in any shipping architecture. That single letter is the tell of second-hand transcription or synthesis. The Amazon ban on a third-party AI checkout agent has no public record โ but the pattern is real, with precedent. The 15,465 server count and the 0.45 percent tunnel figure match the order of magnitude of independent scanning research, which means they are plausible rather than confirmed. Google's disclaimer against life-safety-critical use has substantive equivalents in existing Nest terms.
In due diligence we call this framework validity with evidentiary weakness. A model can be right for the wrong reasons, and the correct response is not to discard the model โ it is to strip its evidentiary weight to near zero and keep the structural claim. So: high confidence on the three choke points, lowest possible confidence on the facts. Everything below is weighted accordingly.
Start with the first choke point, because it is the one the industry consistently misnames. MCP solves capability discovery. It does not solve authorization governance. The protocol's job is to advertise tools, resources, and prompts over JSON-RPC so an agent can find them. Its authorization framework, OAuth-based, only arrived in 2025, and it still lacks the one primitive that matters: a fine-grained, delegable, revocable capability credential. There is no protocol-level way to say this agent may unlock the front door between eight and six for this specific person, and nothing else, and the grant expires Friday.
Absent that primitive, the platform does the only thing it can do. It says no locks. That is not a commercial moat wearing a security badge โ although it functions as one โ it is technical debt being discharged by the nearest available party. When I reviewed institutional custody arrangements in 2025, I found the same shape: multi-signature security promised in the architecture diagram, single-point-of-failure workflow in the operational reality, roughly a hundred million dollars of exposure sitting in the gap between the two. The gap is never in the cryptography. It is always in the delegation model nobody wrote down.
The attack surface is not theoretical. Tool poisoning โ malicious instructions hidden inside a tool description the model reads but the user never sees โ was publicly reproduced in 2025. So was the rug pull, where a benign tool changes its description after installation. So was the confused deputy, where an agent is induced to act beyond its intended scope. So was token passthrough. All four are documented, not hypothesized. What changes in a home is the consequence class. In a browser, a confused deputy leaks a session token. In a hallway, it opens a door. That is not a risk magnitude increase. It is a risk category change, and the industry is still filing it under the first heading.
The second choke point is where the analysis gets interesting, because the platform veto is routinely read as antitrust when it is actually liability insulation. Every instruction in a cloud-mediated architecture must transit the platform's cloud. That makes the platform, structurally and unavoidably, the policy enforcement point. It is the only place in the stack where a rule can be executed rather than requested. This is an architectural choice, not an implementation defect โ and the genuine fork in the road is local-first control over Matter and Thread versus cloud mediation. Choose local-first and you lose the identity and policy stack entirely. Choose cloud and you accept a single party holding veto. There is no third door, and the roadmap slides that imply otherwise are marketing.
The vendor disclaimer is not legal boilerplate. Not for life-safety-critical use is a public line drawn around a liability boundary, in writing, by the party with the most information about where the boundary sits. Read it as an admission, not a formality. And read the absence around it carefully. Silence is the loudest indicator of risk. The document never asks who pays when a lock opens at the wrong hour. Neither does the industry. That silence is the actual product specification.
The third choke point follows directly. The approval card โ the tap-to-confirm prompt before an agent executes โ is not an interaction design failure. It is a liability hedge. Someone clicked, therefore someone owns the outcome. The friction is a byproduct of the hedge, not its purpose. And the reason the hedge exists at all is a missing transaction semantic: software actions generally roll back, physical actions generally do not. You can revoke an API call. You cannot un-open a door.
I spent three weeks in 2020 inside a lending protocol with fifty million dollars of total value locked. The Solidity was elegant โ genuinely beautiful, minimal, the kind of code that makes you want to trust it. The vulnerability was in the price feed aggregation, a manipulation vector reachable through latency rather than cryptography. I disclosed privately rather than publicly, on the theory that a quiet fix beats a loud fight. The team moved slowly. TVL bled forty percent over two weeks while arbitrageurs did what arbitrageurs do. The lesson I took was not that the team was negligent. It was that beauty in code is not security, and that a price feed is a promise about the world rather than a fact about the world.
A door sensor is an oracle. It reports state with latency, and the agent acts on the report. DeFi has spent five years learning that oracle latency is the Achilles heel of the entire category, and that decentralized feeds operated by a handful of nodes is a joke with excellent marketing. Home agents are about to relearn the same lesson, except the liquidation event is a front door at three in the morning.
Identity is the fourth problem, and the one with the clearest compliance precedent. Household facial recognition generates biometric templates, which under GDPR Article 9 are special-category data requiring explicit consent. The household exemption does not survive the template leaving the device โ and in a cross-ecosystem architecture, it always leaves. Illinois BIPA has produced nine-figure class action outcomes against consumer facial recognition. The precedent is not emerging; it is settled. And the hard cap of six registered users is not an arbitrary product decision. It is a false-accept and false-reject rate tradeoff against template capacity, and it happens to land precisely at the edge of what is defensible in an audit. Beauty is the mask; geometry is the bone. The cap is geometry.
Which leaves the constraint that actually blocks commercialization. Liability allocation across four parties โ model provider, platform, device vendor, end user โ is entirely absent from the document and from every product brief I have read this year. No allocation means no underwriting. No underwriting means no insurance product. No insurance means no scale. The code does not lie, but the contract can โ and here the contract does not exist at all. This is a commercial blocker wearing a technical costume, and the industry keeps trying to solve it with better models.
Then there is the layer nobody covers. Who qualifies as one of the six registered users? Is the domestic worker excluded by default? What is the permission model for tenants, for minors, for guardianship, for a household where one adult is controlling another? Smart-home surveillance as an instrument of coercive control is a documented pattern with no technical mitigation. A six-user household is, functionally, a DAO without a charter. I have spent years reading governance tokens that confer no dividend and no operational control, where the holder's only exit is a later buyer at a higher price. The household permission roster is the same theater at smaller scale: a membership list presented as a governance model, with no revocation process, no dispute path, and no defined authority to change it.
Here is what the bulls got right, and it deserves saying because the criticism above is easy. The veto, the approval card, and the six-user cap are honest. Each one is the market admitting that no authorization layer exists. Ripping out the veto before that layer is built would be reckless, not progressive, and the regulators who will eventually force platform openness should be told that plainly rather than handed a competition complaint. The platform is currently the only functioning safety backstop in a market with no liability framework, and it is a crude one โ but it is the only one.
The document's genuine blind spot is subtler. It treats the human click as the only available answer, which is a failure of technical imagination rather than of analysis. Cryptographic mandates already exist: pre-set rules governing spend ceilings, merchant allowlists, category restrictions, and time windows, executed without a click but fully auditable afterward. Agent-scoped payment tokens and one-time virtual cards are in production at the card-network layer. Account abstraction session keys accomplish the same thing on-chain. No human click, but fully attributable is a solved problem in search of a liability framework โ not a research program.
The sequencing question is the one worth arguing about. Build the mandate layer first, then litigate the veto. Do it in reverse and you get exactly the 2026 the document imagines: an ecosystem open on paper, closed at the lock, with a disclaimer taped to the doorframe.
So the question is no longer whether home agents will be permitted to act in physical space. They will. The question is which entity publishes an authorization schema โ with delegation, revocation, an immutable audit trail, and a named liable party โ before a regulator writes one for them, badly, on a deadline. Hype is noise; structure is signal. The lock is structure. Every other item on the roadmap is noise, and the difference between the two will be decided by whoever writes the mandate spec first.