Three brokers have shipped three different answers to the same question in the space of a few weeks, and the differences are more revealing than the products.
IG connected its platform to AI agents over MCP, but read-only: the agent can analyze, it cannot touch. ThinkMarkets went further: its MCP server lets an agent execute trades, but, in the company's own words, the AI "can execute trades, but not access funds." Robinhood went all the way: agent trading on live brokerage accounts, with research, order execution, and portfolio rebalancing running through its MCP server. And the platform layer is following - MetaQuotes' new MetaTrader 5 beta (Build 6030, released July 16) adopts MCP as a native interface, so external agents can plug into charts, accounts, and execution workflows directly. Webull, Deriv, and eToro have MCP servers of their own. cTrader and TraderEvolution ship vendor-level agent infrastructure. Trade press now covers this as a race, and FINRA's 2026 Regulatory Oversight Report already flags agent-driven execution as something that needs governance frameworks.
Line these up and you get a spectrum: look-only, trade-but-never-withdraw, full autopilot. It is a real spectrum, and the industry is having a real debate about where on it to sit.
But notice what the spectrum measures. Every position answers one question: how much execution authority should an agent get? And every position holds one variable constant: the funds sit with a custodian. The broker holds the account. The exchange holds the balance. The debate is about the length of the leash, never about who holds the money.
The custody case, taken seriously
Custody is winning by default, and not because anyone is foolish. It answers hard problems cheaply.
An AI agent has no legal identity, no assets in its own name, and no way to be sued. When it trades against you and something breaks, a custodial broker gives you what the law understands: a licensed intermediary, a complaints process, a regulator with jurisdiction. FINRA flagging governance frameworks is the system working as designed.
Custody is also the only option for some assets. A share of stock is not a bearer instrument; it is an entry in a broker's ledger inside a depository's ledger. There is no such thing as trustless on-chain settlement of your Robinhood equities position, and pretending otherwise would be dishonest. For equities, the spectrum above is the whole game.
And the demand side is real. The first serious dataset on the agent economy, a study by crypto market maker Keyrock run with Coinbase and the Tempo blockchain, counted over 104,000 registered agents across 15+ directories, settling 176 million machine-to-machine transactions worth $73 million between May 2025 and April 2026. Average transaction: about $0.31. Agents are already trading. They will reach for whatever rail exists.
What the same dataset says back
Here is the number from that study that should slow you down: roughly 98% of those machine-to-machine settlements moved through a single company's stablecoin. Keyrock's own researchers put the risk plainly: one regulatory challenge, one de-peg, one sustained outage at that issuer, and the agent economy has no fallback.
That is the baseline concentration. Now add the broker wave on top. Every custodial seat added this year introduces another balance sheet the trade depends on, another honeypot worth attacking, another permission gate on who gets to trade. Concentration stacked on concentration, one convenient integration at a time.
For crypto assets, and only for crypto assets, this is a choice rather than a necessity. Coins and tokens are bearer instruments. They can settle without anyone holding them in the middle. That is the one property that made the asset class interesting in the first place, and it is exactly the property the agent economy's current architecture is quietly giving up.
The missing end of the spectrum
Atomic settlement via hash-time-locked contracts (HTLCs) is the fourth position the broker race does not include: nobody holds the gap.
The mechanics fit in a paragraph. Two parties lock funds on their respective chains against the same hash. To claim the leg you are owed, you reveal the secret preimage, and that same revelation lets your counterparty claim theirs. If either side walks away, both legs refund after timeout. There is no state of the world where one side has both legs, and no intermediary who ever holds either. Your money never leaves your wallet until theirs arrives.
Honest tradeoffs, because they are real:
- Capital locks up for the duration of the swap, and the timeout windows are a design parameter you must get right.
- If you go offline at the wrong moment, you rely on the refund path, not on a support desk.
- It only works for on-chain bearer assets. Equities stay with the brokers. This is a settlement layer for crypto legs, not a replacement for your brokerage.
- Liquidity has to be bootstrapped pair by pair, while custodial venues start with deep books.
What about accountability, custody's strongest card? That is a layer, not a reason to hand over funds. In our stack it looks like a verified counterparty directory with tiered KYC: agents and their operators verify once, at a level matched to their size, and counterparties can require a verification tier before quoting. Execution rewards point the incentive the same direction, rewarding counterparties that complete settlements cleanly. You get someone to hold responsible without someone holding the money. Identity and reputation efforts like ERC-8004 push the same direction at the standards level; they compose with atomic settlement rather than compete with it.
This is not hypothetical plumbing. The RFQ plus HTLC flow runs end-to-end on Ethereum mainnet today, exposed to agents as MCP tools via @hashlock-tech/mcp (v0.4.1 on npm). Sui contracts are deployed and CLI-tested, with gateway wiring in progress. Bitcoin is validated on signet, mainnet pending. The protocol design is written up in our SSRN paper, and the project lives at hashlock.markets.
Scaffolding or architecture?
So the debate we are running today, and I will state both readings as strongly as I can:
Reading one: custody is the architecture. Regulation demands an accountable intermediary, agents' owners want a throat to choke, equities require it anyway, and convenience compounds. The 98% number is not a bug, it is what production infrastructure looks like. In 2027 the agent economy settles inside brokers and exchanges, and trustless settlement stays a niche for ideologues.
Reading two: custody is the scaffolding. Every payments era starts by borrowing the previous era's intermediaries and ends by removing the ones that were only there out of habit. The 98% number is an early-stage artifact, the honeypots have not been seriously attacked yet, and the first eight-figure custodial failure in an agent context sends volume toward rails where failure of an intermediary is not a possible state.
We are building for reading two, which tells you our bias. But the broker race is real evidence for reading one, and pretending otherwise would make us worse at our job.
Which reading do you find more convincing, and what evidence would change your mind? If you run agents that trade, I am especially interested in whether custody was a factor you chose or a default you inherited.
Top comments (0)