The Most Dangerous Part of Agent Plugins 1.0 Is What It Does Not Specify

Let me be clear: the Agent Plugins 1.0.0 announcement is not an npm moment. It is a distribution land-grab wearing an npm-shaped costume. On August 6, 2026, Amazon, Microsoft, OpenAI, Vercel, and Cursor simultaneously adopted an open, vendor-neutral standard for packaging Agent Skills and MCP servers into portable plugins. The spec is shipped and integrated into VS Code, GitHub Copilot, Cursor, ChatGPT, and Kiro. Google joined as a core maintainer the same day, with Kevin Hou leading from the Google Developers side, and shipped two plugin producers—its Agents CLI and Data Agent Kit—even though Google is not yet listed as a client entry. The Technical Steering Committee includes Clare Liguori from AWS, Roshan Sadanani from Cursor, Harald Kirschner from Microsoft, Gav Verma from OpenAI, and Jonathan Hefner from Vercel as lead core maintainer. The project name, logos, domains, and GitHub organization are held in trust by a neutral entity. That is the part that looks healthy. The unhealthy part is what the standard deliberately excludes: installation mechanisms, distribution protocols, provenance verification, permission models, sandboxing requirements, and marketplaces. I started reading at the packaging layer because that is where economic power hides. A standard that packages capabilities but not trust is not a standard. It is a format waiting to be captured by the first vendor that ships a reliable distribution channel. If you have never watched an ecosystem collapse around a bad package manager, this might sound like progress. In 2016, I was working with Node tooling when the left-pad package was unpublished and thousands of builds failed within hours. The lesson stuck with me: package formats are not neutral. The person who controls the registry controls the ecosystem. The npm moment came with both a format and a central registry, which created a single point of failure but also a single point of trust. Agent Plugins 1.0 is the format without the registry. It defines how a plugin is packaged, how agents.md is structured, and how MCP server endpoints are declared. It does not define how a plugin is found, installed, or verified. That trust gap is not an oversight. It is the business model. The timing matters too. The IETF DAWN working group spent July in Vienna debating the discovery layer beneath agent ecosystems, and its charter was deferred at IETF 126 despite 12 pre-charter Internet-Drafts. Agent Plugins does not solve discovery; it solves packaging. But the simultaneous announcement on August 6 was not a coincidence. The industry chose shipping over consensus. That is usually a good instinct for engineers and a dangerous one for markets. Vendors prefer a minimal format because a minimal format leaves the expensive, high-margin layers open for capture. I have audited DeFi contracts where the same pattern appears: an “open” interface combined with privileged state transitions. If you own the function that updates the registry, you do not need to control the standard. You just need to control the integration point. The core of this analysis is not what the plugin manifest contains. It is what the manifest omits. Version 1.0 has no cryptographic signatures, no standardized permission model, and no sandboxing requirements. The VS Code documentation reportedly states that plugins are implicitly trusted at the moment of installation. That is one sentence away from “run arbitrary code with the user’s full privileges on every developer machine.” For an individual developer, that is a convenience. For an enterprise running regulated workloads, it is an unmanageable compliance problem. Code does not lie, but it often forgets to breathe. A plugin that is blindly trusted at install time does not lie to you either. It just does not give you a chance to ask questions before the install hook executes. The economic logic follows directly from the technical omissions. Because the spec defines no marketplace and no registry, each platform operator controls the channel through which agent skills reach users. VS Code has its extension marketplace. Cursor has its own directory. ChatGPT has its own plugin flow. Copilot and Kiro will have theirs. The platform operator who ships the client becomes the gatekeeper. Developers who build high-value agent skills are not merely building for an open standard. They are choosing which gatekeeper controls their access to enterprise buyers and their path to revenue. That is structural fragmentation, not accidental fragmentation. Each client will define its own discovery and installation experience, and the switching cost for an enterprise becomes commercial rather than technical. Migrating a fleet of agent skills from one platform to another means re-packaging, re-negotiating access, and re-verifying provenance that the standard does not provide. Openness at the packaging layer does not mean openness at the distribution layer. Open specs are cheaper than open markets. I want to be precise about what I mean by the trust gap. In smart contract audits, we call this a privileged external call: the contract delegates state changes to an external address without validating the payload. Here, the client delegates execution to a plugin without validating the plugin’s identity. The demand for governance layers is not theoretical. OpenAI launched Presence in July as a governance-focused control plane for enterprise agent behavior, and it lands exactly where the trust gap is widest. As MCP gateways crystallize into enterprise infrastructure, companies will need to layer proprietary control planes on top of the open plugin format to manage risk. The open standard becomes the substrate; the proprietary governance layer becomes the product. That is the most likely path to profit in this new agent economy. Most observers will read Anthropic’s absence from the coalition as a losing move. I read it differently. Anthropic authored the underlying Agent Skills specification and developed the .claude-plugin format that informed the standard. Yet Claude Code is not among the launch clients, and no Anthropic representative sits on the Technical Steering Committee. The coalition’s format supports the portability of a minimal plugin manifest. Claude Code’s plugin format supports a broader feature set: custom subagents, hooks, LSP servers, and background monitors. It is tied to Anthropic’s own client structure and uses claude.md rather than the agents.md convention adopted by the coalition. The tradeoff is explicit: richer platform-specific capabilities versus portable-but-minimal interoperability. Anthropic seems to be betting that capability and control will beat compatibility in the long run. That is risky, but it is rational. If the coalition spends the next two quarters arguing about sandboxing, dependency resolution, and permission models, Anthropic will keep shipping deeper tools inside its own ecosystem. It may lose the packaging war and win the agent war. Gas wars are just ego masquerading as utility, and plugin format wars are just ego masquerading as interoperability. The immediate test is whether the Technical Steering Committee maintains genuine neutrality or allows platform-specific friction to persist. The governance charter is designed to prevent any single vendor from holding a majority—each seat belongs to an individual, not a company. But written governance cannot override the economic fact that each client owns its installation flow. The real enforcement will be whether competing clients implement the spec in compatible ways. If a user can install the same plugin file on all five clients without a vendor account, the standard has traction. If not, the standard is not open. It is just a common envelope for separate mailrooms. The spec is licensed under CC-BY-4.0, and the code is licensed under Apache-2.0. That is about as open as legal instruments can get. But legal openness is not operational trust. The coalition has lowered the barrier for building agent skills, which is good for innovation. It has also removed the burden of verifying those skills from the platform itself, which is excellent for the platforms and terrible for the users. Enterprises should start asking one specific question before they choose a client: who verifies the thing I am about to execute? The answer will determine whether the agent economy remains a genuinely open market or collapses into a series of walled gardens with a shared file format. The standard is shipped, but the trust model is not. And in software, trust is not a later phase. Trust is the load-bearing wall. Builders who ignore it will find that their plugin ecosystem works beautifully until the first malicious package runs with full user privileges. Code does not lie, but it often forgets to breathe—and a standard that does not ask for identity will not protect anyone from the plugins it lets through.