Seven thousand robot vacuums across 24 countries stopped obeying their owners in February 2025. The cause was not a firmware bug. It was a leaked MQTT token — a single credential, exposed once, letting anyone on the network push commands to hardware sitting inside people's homes. DJI's Romo fleet is the cleanest case study we have of a cheap, connected device trusted by default.
That was one agent. One protocol. One failure mode.
The September 2026 roadmap is a house full of them. Anthropic's Model Context Protocol — MCP — has become the plumbing that lets a thermostat, a door lock, and a voice assistant negotiate with each other without a human in the loop. Sonos 27 is pushing an open MCP platform across a 53-million-device install base. Amazon shipped Alexa+ in July at $19.99 a month. Google's Gemini Premium sits at $10-20. The pitch is identical across all three: your home runs itself.
The pitch is also where the accounting gets dishonest.
MCP is a standardized way for AI agents to call tools. A model asks for something — "lock the front door," "set the thermostat to 19C" — and the protocol routes that request to a server that talks to the device. It runs over several transports. The one that matters here is STDIO: standard input and output.
STDIO is fast, local, and cheap to implement. It also passes raw strings straight to the operating system. The Cloud Security Alliance flagged this in a May 2026 report: MCP's STDIO transport does not sanitize or validate the commands it executes. Anthropic has confirmed this is a known design choice, not an oversight — with remediation pushed downstream to whoever writes the server.
Read that twice. The protocol hands developers a loaded weapon, and the safety manual is optional.
The adoption numbers are the part I want to audit. The reporting claims roughly 200,000 MCP instances and 150 million downloads. We didn't get a methodology for either figure. Instance counts and download counts are not the same unit — one is deployment, one is acquisition — and nobody reconciled them. Treat the ratio as narrative, not data. What we do know: a widely deployed protocol with no input-sanitization layer is a large attack surface, and the number of exposed servers is a rounding error away from very bad.
Here is the mechanical problem. In a single-agent home, a compromised node is contained. In a multi-agent chain, the failure propagates. One report puts cascading-failure rates at 72.4% — that a single hijacked server can infect an entire chain. No measurement environment. No failure definition. No sample size. I can't underwrite a number like that. But the direction is right, and direction is what matters when you are sizing tail risk.
The reason is architectural. OWASP's 2026 Agentic Applications Top 10 formally lists Agent Goal Hijack, Tool Misuse, and Cascading Failures as standing risks. That is not marketing. It is a security community conceding that the attack classes are real and unsolved.
Now layer on the responsibility vacuum. No single vendor owns end-to-end protection of the chain. Google owns Gemini. Amazon owns Alexa. Sonos owns the MCP layer. The homeowner owns the consequence. That seam is not a bug in the market — it is the market.
The cost of closing the seam is exactly what nobody prices. Estimates put security and compliance at 20-35% of total build cost for these systems. Again, unsourced. But cross-check it: in financial and healthcare IT, security routinely eats 15-25% of the budget. A 20-35% range for a consumer product with a $10-20 monthly ceiling is not implausible — it is fatal. You cannot fund bank-grade security on a Netflix-tier subscription unless someone else is paying.
Follow the money and the subscription price stops making sense. $19.99 a month does not cover hardware, cloud inference, model calls, and a security layer at 20-35% of build. Sonos's "open, free" MCP standard is the tell. Free protocols are how you become the standard — and standards capture value later, somewhere else. That is the game. It always was.
Then the coverage gap. One figure claims only 8.5% of public MCP servers implement OAuth. Unsourced, but consistent with early-stage protocol adoption: authentication is the first thing cut when you are shipping. Another puts 90% of agent activity outside full visibility, with only 24.4% fully observable. When 90% of the traffic is dark, your incident response is a guess dressed as a plan.
The consensus read on all this is that smart-home agents are insecure and we should be scared. That framing misses the trade. The real risk is not that your door lock gets hijacked. It is that the security spend — the 20-35%, the audit tooling, the OAuth rollout — gets capitalized by the wrong people and repriced onto you at the exact moment the market cannot absorb it.
Here is the decoupling. Security investment and security outcomes are not the same line. Regulation will force spend; it will not force safety. The EU Cyber Resilience Act's September 11 reporting obligation — 24 hours to disclose an exploited vulnerability — creates a compliance cost. It does not create a sanitized STDIO transport. The US Stop Rogue AI Act, proposed September 9, targets frontier models, not the MCP server running your blinds. Both frameworks leave the agent layer uncovered, which means vendors will buy the paperwork and skip the plumbing.
We didn't see this movie for the first time. It is exactly what happened with KYC in DeFi: the compliant surface gets audited, the actual risk routes around it. Yields don't come from the security budget. They come from whoever is willing to skip it. In a bear market, that willingness is precisely what gets funded.
The Tel Aviv University work from August 2025 is the useful counterweight — it maps the failure classes rather than scoring them. That is the correct posture. Map the seams. Distrust the percentages. A 72.4% cascade rate and an 8.5% OAuth rate in the same document, both without sourcing, tell you more about the author's motive than the system's geometry.
What I would actually watch is the wrapper layer. If AWS, Azure, and GCP ship official MCP security middleware, the seam gets absorbed at the infrastructure tier and the consumer standard war is effectively over — the security tax is socialized and the subscription math survives. If they don't, every $19.99 plan is a liability the homeowner holds but never sees on the invoice.
We didn't build the audit layer. Someone will. The only question is whether it exists before the first September cascade — or after the first invoice nobody can pay.
