August 6, 2026. Five platform operators — Amazon, Microsoft, OpenAI, Vercel, and Cursor — simultaneously shipped Agent Plugins 1.0.0, an open standard for packaging Agent Skills and MCP servers into portable plugins. This is not a white paper. It is working code, already embedded in VS Code, GitHub Copilot, Cursor, ChatGPT, and Kiro. Google joined as a core maintainer the same day, with Kevin Hou leading from the Google Developers side, shipping two plugin producers though no client entry.
The timing was not accidental. The IETF DAWN working group spent July in Vienna debating the discovery layer beneath agent ecosystems. Its charter was deferred at IETF 126, despite twelve pre-charter Internet-Drafts. The industry chose shipping over consensus.
That tells you everything about how this market will behave. Standards are plumbing, but the absence of distribution infrastructure in that plumbing reveals where the economics actually live.
I spent the first half of 2026 running economic simulations of autonomous AI agents transacting on L2 rails. The volume projections are real — my models suggested a 500% surge in transaction throughput once agents could execute micro-transactions autonomously, and I eventually proposed a hybrid proof-of-work/stake model to prevent spam flooding. The infrastructure question was never whether agents would transact. The question was always who controls the rails. Agent Plugins 1.0 answers that question with a deliberately empty space.
What the Standard Actually Is
The technical specification is clean. Agent Plugins 1.0 packages Agent Skills — the capability definitions that tell an agent what it can do — and MCP servers, the execution endpoints, into a single portable unit. The license is CC-BY-4.0 for the spec, Apache-2.0 for the code. The project name, logos, domains, and GitHub organization are held in trust by a neutral entity. The Technical Steering Committee — Clare Liguori from AWS, Roshan Sadanani from Cursor, Harald Kirschner from Microsoft, Gav Verma from OpenAI, and Jonathan Hefner from Vercel as lead core maintainer — is designed so no single vendor holds a majority. Each seat belongs to an individual, not a company.
This is as close to a genuine open standard as this industry has produced. The packaging format is vendor-neutral, the governance is structured, and the entities involved have real distribution reach.
Now read the exclusion list.
Agent Plugins 1.0 deliberately omits: installation mechanisms, distribution protocols, provenance verification, permission models, sandboxing requirements, and marketplaces. The spec defines how a plugin is packaged. It does not define how a plugin reaches a user.
That omission is the most consequential design decision in this release.
The Gatekeeper Economy
Every platform operator who ships a client now controls the distribution layer. VS Code, Cursor, ChatGPT, Copilot, and Kiro will each define their own discovery and installation experience. There is no registry in the standard. There is no marketplace in the standard. The spec is a shared file format wrapped in divergent commercial channels.
For developers building high-value agent skills, this changes the calculus entirely. You are not building for a standard. You are choosing which gatekeeper controls your access to enterprise buyers and your path to revenue. The fragmentation is structural, not an oversight. It was designed into the standard through deliberate omission.
This maps directly to what I have observed in crypto infrastructure over the past eight years. Regulatory licenses became the deepest moat for exchanges after the enforcement wave — newcomers simply cannot afford the entry ticket. The same dynamic is emerging here. The platform operator who controls distribution is the new licensed exchange, and the entry ticket is encoded in the standard's silences.
For enterprise technology leaders evaluating agent deployments, the switching cost is no longer technical. It is commercial. Every client ecosystem becomes a separate vendor relationship with its own discovery mechanism, its own governance expectations, and its own pricing power. In my 2020 DeFi yield analysis work, I learned to quantify hidden structural costs rather than accept surface narratives. The same discipline applies here: the plugin format is free. The distribution channel is the tax.
Anthropic's Calculated Absence
The body language matters. Anthropic authored the underlying Agent Skills specification. Anthropic created the .claude-plugin format. Claude Code is not among the launch clients. No Anthropic representative sits on the Technical Steering Committee.
Claude Code's plugin format supports a broader feature set: custom subagents, hooks, LSP servers, background monitors. But it is tied to Anthropic's client structure and uses claude.md rather than the agents.md convention the coalition adopted.
This is a deliberate bet. Anthropic is choosing platform-specific richness over portable minimalism. They are betting that depth of capability will win over breadth of compatibility. It is the same strategic divide that has always separated protocols optimizing for composability from those optimizing for control.
The market will decide. But the absence is not an accident — it is a positioning statement.
The Trust Vacuum
Here is the uncomfortable part. Version 1.0 contains no provenance model. No cryptographic signatures. No standardized permission model. No sandboxing requirements. Per the VS Code documentation, plugins are implicitly trusted at the moment of installation.
For an enterprise environment where security and compliance are non-negotiable, this is a genuine obstacle. But the trust gap is not a flaw in the standard. It is the most valuable business opportunity in the stack.
OpenAI Presence, which launched in July as a governance-focused control plane for enterprise agent behavior, is positioned to fill exactly this role. As MCP gateways crystallize into enterprise infrastructure, companies will layer proprietary control planes on top of the open plugin format to manage risk.
Code does not lie, but incentives often do. The standard says "open." The economics say "compliance layer required." Both statements are true, and they resolve in favor of the gatekeepers who can sell trust.
Liquidity is the only truth in a vacuum of trust. In the agent economy, the liquidity is not capital — it is the distribution of agent capabilities into enterprise workflows. Whoever controls that pipe controls the fee structure.
The Decoupling Thesis Everyone Will Miss
The narrative will be: "Open standard, open ecosystem, fragmentation solved." That story is false. The standard solved packaging, not distribution. The discovery layer that DAWN failed to standardize in Vienna will be built privately, per client, per platform. Not because consensus is hard, but because the business model demands it.
And the trust deficit will compound the fragmentation. Each platform will build its own governance overlay. Each will define its own security expectations. The plugin format becomes a common file type — like the PDF — while the value extraction moves to the viewer, the distribution channel, and the compliance wrapper.
In DeFi, I watched the industry manufacture a "liquidity fragmentation" narrative to justify new middleware products every cycle. This is different. Here the fragmentation is real because the standard's authors deliberately left distribution unspecified. That is not an engineering oversight. It is a revenue decision embedded in a technical standard.
The absence of a trust model is not a bug waiting for a patch. It is a market waiting for a toll collector.
Yield without basis is just delayed liquidation. A standard without distribution is just a file format waiting for a gatekeeper. The agents will transact. The question is which layer captures the spread.
Positioning for the Cycle
The immediate test is whether the Technical Steering Committee maintains genuine neutrality while every member's employer operates a competing distribution channel. Governance charters are words. Compatible implementations are evidence.
If competing clients actually implement the spec in interoperable ways, the packaging layer remains open and value concentrates in the governance layers above it. If they do not — if each client quietly adds proprietary friction to its discovery and installation paths — then the shared file format becomes a facade over walled gardens. Both outcomes are profitable for the incumbents. Only one is profitable for the developers.
Watch the first compliance incidents. Watch how each platform handles a malicious or poorly-vetted plugin. That response — not the version number — will define the agent economy's actual trust layer and, by extension, its liquidity distribution.
The standard lowered the barrier for building agent skills. Whether the market those skills serve remains open is a different question entirely. And that is the only question that matters for the next phase of the agent economy.
