The Missing Clause in Agent Plugins 1.0

Five tech giants just agreed on how to package an AI agent extension. They still cannot agree on whether you should actually run it. On the eve of GPT-5's first birthday, OpenAI, Amazon, Microsoft, Cursor parent Anysphere, and Vercel published Agent Plugins 1.0.0—an open, vendor-neutral specification that lets developers bundle reusable instructions and tool connectors into a directory that any compliant client can theoretically load. Google joined as a core maintainer hours after the announcement. The pitch is seductive: build a skill once, ship it everywhere. But the specification's most revealing feature is not what it contains. It is what its authors explicitly refused to touch. The standard defines a directory structure. At the root sits a plugin.json manifest that requires only two fields—a schema reference and a name. A skills/ folder holds reusable instructions. An mcp.json file configures connections to live tools and data. That is the portable surface. Everything below that surface—installation flows, permission gating, sandboxing, runtime trust verification, user experience—stays with each client. The document is labeled a Working Draft. The Technical Steering Committee, which counts Anthropic's absence as one of the most commented-on facts of the launch, may consider adding component types later "as semantics converge and a demonstrated portability need emerges." The result is a format that solves the packaging problem and nothing else. And that might be exactly the right call—because the problems it leaves unsolved are genuinely dangerous right now. The claw marks on the registry No one needs to imagine what a compromised Agent Skill looks like. Earlier this year, a security team at Koi Security audited ClawHub, the primary distribution registry for the open-source OpenClaw agent framework, and found 341 malicious skills packed with commands that trick users into executing terminal operations or downloading unsigned binaries. The operation, which Chinese threat intelligence firm Antiy CERT later dubbed "ClawHavoc," exploited a simple gap: the registry had no reliable way to verify whether a skill's SKILL.md file was a helpful instruction set or a social engineering payload. The numbers kept climbing. Researchers catalogued 1,180 malicious skill packages out of 3,498 on the platform. By June 2026, another 23 plugins were caught impersonating official organizational scopes—using @openclaw/ or @clawhub/ namespace prefixes to look like first-party tools. Six of those 23 had already been flagged by ClawHub's internal scanner. Seventeen had not. Some plugins executed autonomous payment operations and exported agent configurations without user awareness. The vulnerability is not theoretical. CVE-2026-25253, rated CVSS 8.8, documented a specific attack path where a malicious SKILL.md instructed an agent to exfiltrate Apple Keychain credentials via a simple curl command. The patch came after the proof-of-concept was already circulating. Agent Plugins 1.0 does not address any of this. "The standard does not address whether a component should be trusted, how permissions are granted, or what sandboxing applies," the specification states. A compromised plugin that follows the format perfectly can exfiltrate API keys, read local files without authorization, and hijack the agent's objective. Installed plugins typically run with the user's full permissions. There is no sandboxing requirement in the spec because sandboxing is a client-side problem—and the spec is explicitly not in the client business. Dax Raad, who builds the SST developer-tools framework, called the effort "a thin standard" whose useful parts will inevitably drift back into client-specific extensions anyway. Raad's skepticism captures a real pattern: cross-platform standards in fragmented ecosystems tend to converge on the lowest common denominator, then fragment again as platforms compete on features the standard does not cover. Agent Plugins' authors appear to accept this outcome. The format includes a namespaced extension mechanism specifically so clients can innovate without breaking the common layer. What Raad sees as a weakness, the committee sees as humility. Implementation friction is already visible in the first 48 hours The gap between a clean specification and a messy production environment showed up immediately. OpenClaw merged support for the Agent Plugins bundle format on August 6—the same day as the launch—but noted that the framework could install bundles from Codex, Claude, and Cursor while failing to recognize the new standard's directory layout. Spec-conformant packages simply would not install. Codex itself was patching compatibility issues: Agent Plugins can have dotted names or version strings that violate Codex's directory-safe format. A pull request from August 2 tried to fix this before the specification was even public. VS Code and GitHub Copilot users working inside Windows Subsystem for Linux reported that plugins failed to read skills because they referenced local Windows paths that do not exist in the WSL environment. In a GitHub discussion from June, a developer noted that Copilot can trigger a plugin's skill via slash-commands but cannot load internal resources—the skill appears at the UI level but is not fully available as a usable workspace resource to the agent. AWS had published troubleshooting documentation covering plugin installation errors, marketplace-not-found failures, MCP server connection drops, and skills that refuse to auto-trigger. "Build once, run anywhere" makes for a fine manifesto. The first 48 hours of real-world deployment suggest something closer to "build once, debug per platform." These are not failures of the standard. They are evidence that the standard picked the right boundary. Packaging is the tractable problem. Runtime behavior across divergent client architectures, operating systems, sandbox implementations, and permission models is the hard one—and version 1.0 does not pretend otherwise. "Agent Plugins defines the portable contract for a plugin and leaves the behavior of the client up to each client," the specification reads. The sentence is both a design principle and a liability waiver. The elephant is the committee itself Anthropic created both Claude and the Model Context Protocol—the very MCP standard that Agent Plugins wraps in its package format. The company is not on the Technical Steering Committee. Its name does not appear in the governance document or anywhere in the specification text. The five companies that wrote Agent Plugins 1.0 effectively standardized Anthropic's technology while excluding Anthropic from the room. The reasons are not officially stated, but the commercial logic is legible. Anthropic runs a zero-commission Claude plugin marketplace. OpenAI has experimented with GPT Store monetization. AWS Marketplace takes 3% to 15% on software transactions. Azure charges comparable rates. Every major platform has bet differently on how—and whether—to extract revenue from the plugin layer. Standardizing the packaging format without touching marketplace governance means everyone keeps their business model intact. Anthropic's participation would have placed its MCP stewardship inside a governance structure controlled by competitors. Its absence may simply be the rational move. Google's last-minute addition as a core maintainer, represented by DeepMind senior engineer Kevin Hou, signals that the standard is broadening. One observer tracking the rollout noted that Google's Vertex AI infrastructure stands to benefit from a standardized plugin layer that reduces integration costs across agent clients. With Anthropic out, Google can shape the standard without the awkwardness of competing MCP visions. Angie Jones, a developer advocate, captured the other side of the argument: "We neeeeded this." Jones wanted a single way to carry her tools between the AI clients she uses daily. For developers who maintain skills for Cursor, Copilot, and Codex simultaneously, the fragmentation tax is real—writing the same functionality three times in three different packaging formats, debugging three different installation paths, and managing three different update cycles. The Chinese tech outlet 36Kr framed the launch as the end of the packaging debate and the beginning of the trust war. "How marketplaces are operated, whether plugins can be trusted, and who should be responsible for security—these are the aspects that 1.0 deliberately left blank," its analysis noted. The standard succeeds or fails not on its technical quality—which is intentionally minimal—but on three external factors: how fast clients adopt the common format, whether the developer ecosystem coalesces around shared registries rather than platform-specific stores, and whether model capability convergence makes plugin ecosystems the real differentiator. The market structure question A shared format could let a small developer reach every major agent at once. That is the open-ecosystem pitch. But standards also reward incumbents. If a skill works identically on ChatGPT, Cursor, and Copilot, the developer has no reason to build exclusively for any one of them—but the user has no reason to leave the client they already use. The standard removes switching costs for users without necessarily reducing distribution power for platforms. Vercel's role as the spec's initiator makes sense through this lens. Vercel has no foundation model and no end-user AI platform. Its value sits in the developer toolchain layer—the SDKs, the deployment pipelines, the build infrastructure. By driving a packaging standard that sits above any single AI client, Vercel positions its toolchain as neutral infrastructure for the multi-agent future. In June, the company reported that 96% of its own marketing work and 93% of customer service interactions were handled by AI agents. Those numbers are not just operational metrics; they are a proof-of-concept demo for a world where Vercel's infrastructure connects agents to the tools they need, regardless of which model vendor built them. The commercial stakes are crystallizing quickly. Microsoft and OpenAI have reportedly renegotiated their revenue-sharing agreement, slashing hundreds of billions of dollars in prior terms. GitHub Copilot added AI Credits with per-token billing on top of its flat subscription. Alibaba is reportedly considering requiring large-scale users of the next Qwen open-source model to share revenue. ByteDance's Coze platform has accumulated over a million developers and two million agents, with paid skill transactions already live. Kimi K3 takes up to a 30% cut on developer earnings above $20 million annually, with negotiations required for higher volumes. In this environment, Agent Plugins is either a neutral commons that keeps distribution costs low for independent developers—or it is the packaging layer that makes it effortless for users to stay inside whichever platform already owns their workflow. Probably it is both, and which effect dominates depends on whether the registry problem gets solved. A Rust implementation of the Agent Plugins specification appeared on August 7, describing itself as "Sans-IO at its core, so a plugin can be loaded from a directory, an archive, an object store, or an async runtime without the library knowing the difference." That architectural choice mirrors the standard's own posture: decouple the packaging from the runtime, and let the ecosystem figure out the rest. The library works because it refuses to care where the bytes come from. The standard works because it refuses to care what happens after the manifest is parsed. The authors are clear about the trade-off. Keeping the boundary small makes the format easier to implement and gives the ecosystem room to converge before adding more portable surface area. Version 1.0 is narrow by design—a bet that solving the easy problem well is better than solving the hard problem badly. Whether that bet pays depends on whether anyone can build a registry that users actually trust. For now, the plumbing is agreed. The water pressure is someone else's problem.