OpenAI and Rivals Launch Agent Plugins, One Open Standard for AI Agent Tools

What happened

On August 6, 2026, OpenAI's developer team published Agent Plugins 1.0.0, an open standard for bundling the tools an AI agent uses into a single portable folder. It did not ship alone. Amazon, Cursor, GitHub, Microsoft and Vercel are listed as co-authors, and Google announced the same day that it had joined as a maintainer. The release landed one year to the day after GPT-5, which OpenAI launched on August 7, 2025.

The pitch is narrow and practical: write a plugin once, and any compatible agent client can read it. Today a developer who wants a tool to work in ChatGPT, Cursor and VS Code often maintains a separate manifest for each. As of the launch, at least six plugin manifest formats were in active use across those clients. Agent Plugins tries to collapse that into one.

What a plugin actually is

A conformant plugin is a directory, not a binary. At its root sits plugin.json, the only required file, and its schema is deliberately small: of ten permitted fields, only name and $schema must be present. Everything else is optional. A skills/ subfolder holds Agent Skills as plain SKILL.md files, which the spec reads one level down with no recursive search. An mcp.json file at the root points to Model Context Protocol servers. Client-specific data lives in reverse-domain folders such as .vscode-plugin/, so one package can carry extras for VS Code without breaking in Cursor.

Two ideas underneath matter more than the file list. Agent Plugins does not invent a new way to describe a tool. It packages two formats that already exist, Anthropic's Agent Skills and the Model Context Protocol, and defers to both. The standard is a wrapper, not a replacement, which is why an existing skill or MCP server drops in without being rewritten.

Who is behind it, and who isn't

Governance is where the announcement gets more interesting than the file format. The specification is run by a Technical Steering Committee whose five initial Core Maintainers come from Amazon, Cursor, Microsoft, OpenAI and Vercel, with Vercel's Jonathan Hefner as lead. A written anti-capture clause says no single company may hold a majority of maintainer seats. Removing a maintainer needs a 75% vote, and changing the charter needs two-thirds. Seats are held by named individuals, not reserved for companies.

One name is missing. Anthropic wrote the Agent Skills specification that Agent Plugins packages, yet it holds no seat on the committee and was not among the launch co-authors. No public statement explains the absence. VS Code, meanwhile, still treats Anthropic's own .claude-plugin/plugin.json as a first-class format it can read. The project is also independent of the Agentic AI Foundation, which stewards MCP; Agent Plugins has not applied to join it.

Where it works today

At launch the standard lists five entries covering six products that can load a plugin: VS Code, Cursor, GitHub Copilot, ChatGPT, Codex and Kiro. That is a real head start for a day-one spec. The compatibility is not uniform, though. ChatGPT and Codex read stdio and streamable HTTP servers but skip the older SSE transport that the other clients still accept, so a plugin shipping an SSE-only server will not load everywhere the badge implies.

The part the spec skips

The 1.0.0 label oversells the maturity a little. The spec text still carries a "Working Draft" status, the repository has no tagged 1.0.0 release, and the format was first committed on July 24, 2026, less than two weeks before the announcement. More to the point, the standard is explicit about what it does not cover. It defines a package layout and nothing else: no installation or distribution mechanism, no registry, no permission or consent prompts, no secrets handling, and no sandboxing between plugins.

That last omission is the one to watch. VS Code's documentation describes plugin MCP servers as implicitly trusted at install, and the spec pushes provenance and signature verification to future work. A portable format lowers the effort of shipping a plugin for everyone, including whoever wants to ship a malicious one, before any signing layer exists. Until that arrives, installing a third-party plugin is closer to running someone's code than flipping a setting.

What happens next

For developers the near-term calculus splits in two. Adopting the manifest for tools you write costs little and widens their reach. Installing plugins others wrote deserves the same scrutiny you would give a dependency, at least until the provenance work lands.

The bigger question is whether a standard can hold together while its largest potential contributor sits outside it. MCP spread in part because Anthropic and OpenAI both backed it. Agent Plugins launches with broad vendor support and a conspicuous gap in the same spot. Whether Anthropic joins, ships its own packaging layer, or the .claude-plugin format simply persists alongside this one will say more about the next year of agent tooling than the folder layout does. The specification and its governance rules are public at agent-plugins.org.