What Could Go Wrong?
Your lights, your thermostat, your security cameras — now in the hands of Claude, ChatGPT, or whatever AI agent you happen to trust. Google just opened the floodgates.
On September 16, 2026, Google rolled out early access to its Model Context Protocol (MCP) server for Google Home, allowing third-party AI agents like Claude, Hermes, OpenClaw, and Google Antigravity to directly control smart home devices and access your entire event history. The company calls it “enabling your agent to interact with your home”. A more honest description might be: handing a stranger the keys to your house and hoping they don’t rearrange the furniture while you sleep.
What Google Actually Announced
The pitch sounds impressive. Your AI agent can now analyze camera footage across rooms, track how many loads of laundry you did last week, build custom dashboards, and even send audio messages through your Google Home speakers when it finishes a task. Setup requires creating a Google Cloud project, configuring Home MCP, and granting permissions to your chosen agent — a process Google describes as “simple” for users paying $20 per month for Google Home Premium Advanced.
Google has built in some safety rails. The system enforces rate limits and prohibits sensitive actions like unlocking doors. Taylor Lehman, Google’s Group Product Manager for Home & Nest, acknowledged in the announcement that “depending on your agent, connecting it to Home MCP can result in unexpected or even undesired behavior”. That’s corporate-speak for: we’re not entirely sure what will happen either.
The Security Nightmare Nobody’s Ready For
Here’s where it gets genuinely terrifying. Researchers from Tel Aviv University and Technion demonstrated in a peer-reviewed study that Google Calendar invitations can hijack Gemini-powered smart homes through a technique called “delayed automatic tool invocation.” An attacker sends a calendar invite with malicious instructions buried in the title. When you later ask your AI to summarize your schedule, it absorbs the hidden commands and waits. Then, when you say something as ordinary as “thanks,” the AI executes the attack — turning lights on and off, opening smart shutters, and activating a boiler.
The research team found that 73% of the threats they analyzed were rated high-to-critical risk for end users. They believe this is the first documented instance of a prompt injection attack producing direct, physical-world consequences.
And the calendar is just the beginning. The Cloud Security Alliance flagged that the Model Context Protocol’s STDIO transport executes operating system commands without sanitization or validation. Anthropic, which created MCP, confirmed the behavior is intentional and declined to modify it. When multiple MCP servers connect to the same agent, the cascade failure rate hits 72.4% — one compromised server infects the entire chain.
The OWASP Top 10 for Agentic Applications 2026 now catalogues these risks: Agent Goal Hijack, Tool Misuse, Insecure Inter-Agent Communication, and Cascading Failures. These aren’t theoretical concerns. They’re documented vulnerabilities in the architecture Google is now rolling out to consumers.
Privacy? What Privacy?
Even if your AI agent never gets hijacked, there’s a quieter problem: the data pipeline. Gemini for Home doesn’t just respond to voice commands — it continuously watches Nest camera video streams, passing raw reality into a text-searchable cloud database so you can ask your speaker whether your dog jumped on the couch today.
XDA Developers called this “a fundamental architectural regression disguised as a user experience upgrade,” noting that what used to be a simple light toggle now becomes a multi-second LLM processing loop that passes ambient household conversations and continuous camera history through Google’s cloud servers. A local Zigbee or Matter command sends a single lightweight binary packet in under 10 milliseconds. An LLM round-trip records your voice, compresses it, streams it to an external server, processes it through a large language model, translates it back into a device command, and routes it back to your house.
That’s not just slower. It’s a fundamental shift in what your smart home is. It’s no longer a local system you control. It’s a data-harvesting subscription service that happens to also turn on your lights.
And Google has a history here. The company agreed to pay $68 million in January 2026 to settle a class-action lawsuit alleging its voice-activated assistant improperly recorded private conversations. Now they want deeper access to your physical rooms.
The Agent Doesn’t Even Work That Well
Perhaps the most damning indictment comes from the New York Times’ Wirecutter review of the new Google Home Speaker with Gemini AI. The reviewer reported that the device ignored song requests, changed the subject of conversations, insisted the day was Tuesday on a Wednesday, and refused to turn off smart lights — claiming it was “unable to control or interact with your home’s lighting or other physical devices”.
“Controlling smart devices is kind of the bare minimum one would expect from a smart speaker,” the reviewer noted dryly.
Other users have reported broken routines, unwanted conversational banter, and smart displays that can no longer set alarms or control lights — basic functions that the old Google Assistant handled without issue. The pattern is consistent: generative AI has made smart speakers chattier but demonstrably worse at the simple tasks they were built to do.
What You Should Actually Do
If you’re tempted by the shiny promise of an AI butler, here’s the uncomfortable truth: the technology isn’t ready, and the security architecture is fundamentally broken.
Google’s own developers acknowledge the risks. The MCP protocol executes OS commands by design. The cascade failure rate when multiple agents connect is over 70%. Prompt injection attacks with physical-world consequences are documented and, according to researchers, not fully resolved.
If you do decide to experiment with Home MCP, the most sensible approach is what Digital Trends recommends: “Give the AI the keys one permission at a time”. Start with something trivial — a single light bulb, maybe. Never give an agent access to locks, security cameras, or HVAC systems. Review Google’s developer policies and terms of service before connecting anything, as the company explicitly advises.
But honestly? Maybe just wait. The agentic smart home is arriving whether we’re ready or not. That doesn’t mean you have to be the beta tester.
