Your Home Agent Is a Bridge, and Bridges Have Trust Assumptions

Meta shipped 5,000 free home devices in October 2026. The firmware is locked; the user cannot reflash it. The chip is an ESP32-C5 — a RISC-V, dual-band Wi-Fi 6 microcontroller with no neural accelerator, roughly $2 to $4 in bill-of-materials cost. It cannot run a language model. Not a small one, not a quantized one, not on a good day. So when the marketing implies "local processing," understand what is actually local: nothing. The inference runs on Meta's servers. The device is a microphone with a subsidy attached. I have seen this exact maneuver before. In 2021 I reverse-engineered the Axie Infinity bridge contract and found a reentrancy surface the team ignored until I published a minimal reproducible proof of concept. The pattern holds across sectors: the word "local" is asked to do the work the architecture refuses to do. Here it is "local." On bridges it was "trustless." Same sentence, different product. The thing actually shipping in October 2026 is MCP — the Model Context Protocol, which Anthropic published in November 2024 as a JSON-RPC 2.0 tool-call interface. It is not a model architecture. It is plumbing, a standardization layer, "USB-C for AI tools." Google implemented it for its home platform. Home Assistant shipped a one-click local MCP server in its 2026.10 release. Apple is behind, with a HomePad reportedly priced near $350 and agent control slipping to late 2026 or early 2027. Read that list the way a crypto reader reads a validator set. An open protocol has become the neutral interface between four competing gardens. Google, Apple, Meta, and an open-source project all speak the same wire format. This is the ERC-20 moment of home automation, and it carries the ERC-20 moment's exact disease: the interface standardizes; the trust layer underneath does not. MCP is a tool-call interface, which means it is a permission interface. When your agent connects to a home MCP server, it receives a list of tools — read device state, read history, arm the alarm, adjust climate. That list is a keyring. And as with every bridge I have audited, the security question is never whether the interface works. The question is who holds the keys, and what happens when the mapping between the interface and the asset drifts. Start with the compute allocation, because it is the load-bearing wall and it is not hidden. Apple runs hybrid: roughly a 3B-parameter on-device model plus Private Cloud Compute for the hard requests. Home Assistant runs genuinely local, on hardware the user buys and maintains, with a local model that is honestly weaker than cloud SOTA. Google runs cloud MCP behind a Google Home Premium Advanced subscription. Meta runs the ESP32-C5, which is architecturally incapable of local inference. So of four players, exactly one — the open-source one — is actually local. The other three use "local" as a pricing tier. The real dividing line was never local versus cloud. It is who holds your device-state graph and your behavioral history. That is the asset. The interface is a distraction dressed as the product. Now apply the bridge lens. LayerZero's verification relies on oracle and relayer trust assumptions; the endpoint is marketed as decentralized while the verification is delegated to two parties you must simply believe. MCP is structurally identical. The protocol is open. The guardrails — which operations are permitted, which sensitive calls are blocked — are defined privately by each vendor. Google blocks "unlock the door." That is not value alignment; it is a coarse allow/deny list, a rule-level guardrail that cannot cover the long tail of edge cases. It is also, conveniently, liability engineering: refuse the high-responsibility scenario, keep the agent inside low-liability territory. The guardrail protects the vendor first and the resident second. The billing model is where the incentive structure becomes legible, and it is the most interesting unsolved problem in the whole stack. Traditional metering is per call, per token. A proactive agent breaks this. It acts without a user request; it consumes compute in the background; it initiates. Who pays for autonomous action? The industry has no answer. This is the gas-abstraction problem wearing a consumer hat: when an agent initiates, the cost has no natural payer, so the cost migrates somewhere the user cannot see. Subscriptions absorb it, which is exactly why the agents are placed behind subscriptions. Greed is the feature; the bug is just the trigger. Meta's model is the honest one in the sense that its dishonesty is legible. Free hardware, locked firmware. Locked firmware means the user cannot cut the data return path. The subsidy is not charity; it is the acquisition cost of a continuous household behavior stream, priced against a $2–$4 MCU. The lock is the enforcement mechanism of the business model. You didn't buy a device. You were rented to as a data source, with the rent paid in hardware. Five thousand units is not a launch; it is a pilot small enough to deny, large enough to measure. Then there is prompt injection. The source flags it as medium-high and notes the absence of any standard protection, and this is the part crypto readers should feel in their teeth. A home agent reads device state to decide. Device state is attacker-influenceable — a sensor value, a device name, a calendar entry. In 2026 I tested an AI trading agent wired to Chainlink and watched it execute on corrupted feed data from a single compromised node. The black box did not question the input; it obeyed it. A home agent reading polluted state is the same attack with a lower body count. The exploit wasn't the model. The exploit was the unverified input the model trusted. Verifiable computation standards are the only real fix, and nobody in the consumer stack is mandating them. The "four questions" framework the source proposes is a genuine audit artifact: does it work offline; can access truly be revoked; who is liable when the agent errs; what happens to the device when the terms change. Map each onto a smart contract audit question and they line up exactly. Can it run without the RPC provider. Is the admin key truly renounced or merely re-labeled. Who eats the loss on a bad oracle. What happens to a contract when the governance multisig upgrades it into a brick. The consumer checklist and the contract checklist are the same checklist. The market treats home agents as a new category. They are a re-skin of an old failure mode: delegation of trust to an interface that does not enforce the promises its name implies. The "revocable access" line deserves its own paragraph, because it is trust engineering and it is precise. Users are told they can revoke MCP access from the vendor app. True, and insufficient. Revocation stops future access. It does not recall the behavioral history already ingested. The device-state graph is copied to the vendor's side the moment the agent reads it; "revoke" edits the future and leaves the past untouched. You didn't get your data back. You got a button that feels like getting it back. The regulatory layer makes the ownership problem sharper rather than softer. A home agent touching door locks and alarms is physical-safety adjacent, which under the EU AI Act trends toward high-risk classification and drags transparency and human-oversight duties along with it. Google's refusal to unlock doors reads as preemptive compliance as much as safety. Local processing satisfies GDPR data-minimization more cleanly than cloud MCP, which quietly makes the open-source path the regulation-friendly one. Meanwhile the question no framework answers is the one that matters most: who owns the household behavior data, the resident or the platform? Until that is defined, Meta's model sits in a legal gray zone and everyone else free-rides on the ambiguity. One more hidden cost. The "local is greener" assumption is unproven. Disaggregating inference to millions of households lowers per-device energy but destroys the economies of centralized PUE optimization; the unit cost of edge inference is higher, not lower, than centralized cloud. Local processing is not efficiency. It is the price of data sovereignty, paid in compute the user does not see on any bill. That is the same sleight as "decentralized is efficient" — a normative preference laundered into a technical claim. Here is where the bulls are right, and I will not pretend otherwise. MCP becoming a cross-vendor standard is a real win, and it is the kind that compounds. When four competing gardens speak one wire format, switching costs fall and the interface layer stops being a moat. That is what ERC-20 did: it commoditized the token contract and pushed competition to everything above and below it. Google implementing Home MCP is the same signal — the protocol is no longer Anthropic's private property, and that is healthy for everyone except the party that wanted to own it. Home Assistant is also right, and it is the only player whose architecture matches its words. Real local, user-owned compute, offline operation. Its business model is weak precisely because its honesty is expensive: it charges labor instead of money, and labor does not scale to the consumer market. But it exists as a moral benchmark that forces the giants to keep the "local" fiction at least plausible. And the source is right about the thing most AI coverage misses: the risk is not hallucination. Hallucination is a quality bug with a bounded blast radius. The real risk is irreversible delegation — permissions granted once, data copied permanently, under terms that can change after purchase. That framing is correct. It is also the framing crypto should steal wholesale, because it is the framing crypto keeps failing to apply to its own bridges. So the question is not whether your home agent is smart. It is who audits the guardrail, and whether "revoked" means the data stopped moving or merely stopped arriving. In 2026, the honest answer for three of four players is the second one. Which means the next bridge exploit will not happen on a chain. It will happen in a living room, and the post-mortem will read exactly like the last one.