Agent plugins are installable packages that add a set of capabilities to an artificial intelligence (AI) agent in one step. A plugin is a folder of files: written instructions the model reads (skills), connections to outside software (usually through the Model Context Protocol, or MCP), shortcut commands, specialised sub-agents and scripts that run automatically at set moments (hooks). Installing the plugin switches all of them on together; disabling it removes them. The format exists because agents become useful only once configured for a particular job, such as auditing an ad account, and that configuration was scattered across settings files, prompts and server lists. A plugin makes it something that can be versioned, shared through a marketplace and installed by someone who never wrote it.

How a plugin is built

Anthropic's Claude Code, the first major product to ship the format, defines a plugin as a directory with an optional manifest at .claude-plugin/plugin.json. According to its plugin reference documentation, name is the only required field, written in lower case with hyphens, and every component the plugin adds is namespaced with it, so a reviewer agent inside a plugin called deploy-tools appears as deploy-tools:reviewer. Optional fields include version, description, author and dependencies on other plugins.

The components sit in conventional folders at the plugin root:

  • Skills in skills/<name>/SKILL.md, each a Markdown file with a name, a description and instructions, sometimes accompanied by scripts or templates. The model loads a skill only when its description matches the task.
  • Commands, short Markdown prompts triggered by a slash, such as /review. The documentation now steers new plugins towards skills instead.
  • Agents, definitions of sub-agents with their own instructions and tool permissions.
  • Hooks in hooks/hooks.json, which attach shell commands, web requests or prompts to lifecycle events such as a file being edited or a session starting.
  • MCP servers in .mcp.json, the connections to external systems such as a CRM, an analytics warehouse or an ad platform.

A variable, ${CLAUDE_PLUGIN_ROOT}, gives bundled scripts the absolute location of the installed copy.

Distribution runs through marketplaces. A marketplace is a catalogue file, .claude-plugin/marketplace.json, that requires a name, an owner and a plugins array, each entry naming a plugin and its source, such as a GitHub repository or an npm package. A user adds one with /plugin marketplace add owner/repo; Anthropic's own, claude-plugins-official, is added automatically and its name is reserved against imitation.

Installs can apply to one user, to everyone working in a code repository or to one user in one repository, and administrators can require a marketplace on every managed machine.

OpenAI's Codex uses the same architecture with different file names. Its documentation describes a plugin as containing "one or more" of skills, MCP servers, browser extensions and hooks, listed in a Plugins Directory shared by ChatGPT and Codex, where workspace administrators can sync a GitHub-hosted marketplace.

Who builds and runs them

Three groups publish plugins. Platform owners ship first-party sets: Anthropic open-sourced 11 plugins for Cowork, its desktop agent for non-developers, on January 30, 2026, covering areas from sales, finance, legal and marketing to customer support and biology research. Software vendors package their products as plugins to reach users inside the agent rather than in their own interface. Communities and companies maintain public or private catalogues, often in a single GitHub repository.

The installer is usually an individual practitioner or an IT administrator. Enterprise deployments tend to centre on a private marketplace that IT controls, so a sales team receives the approved CRM connector and pricing skill and nothing else.

Origin and evolution

The word arrived in AI products with ChatGPT plugins, which OpenAI introduced on March 23, 2023. Those were narrower than today's bundles: a developer documented an application programming interface (API) in an OpenAPI specification, published a manifest pointing to it, and ChatGPT listed enabled plugins in the model's prompt. Twelve partners, including Expedia, Instacart, Klarna, Shopify, Slack and Zapier, built the first ones. OpenAI's launch post acknowledged that red teamers had found ways for plugins, without safeguards, "to perform sophisticated prompt injection, send fraudulent and spam emails, bypass safety restrictions, or misuse information sent to the plugin." The store peaked at "a little more than 1,000 plugins," according to OpenAI's help centre, before custom GPTs replaced it. Since April 9, 2024, conversations with plugins can no longer be continued.

The modern meaning grew out of coding agents. Anthropic released MCP in November 2024 as an open protocol for connecting models to tools, and introduced Agent Skills in October 2025 as folders of instructions loaded on demand. On October 9, 2025, it put plugins into public beta for all Claude Code users, describing them as "custom collections of slash commands, agents, MCP servers, and hooks that install with a single command."

Cowork's plugins in January 2026 carried the format beyond software engineering. On February 24, 2026, Anthropic added plugins for investment banking, wealth management, human resources, private equity, engineering and design, some built with partners including LSEG and FactSet, and said companies could build and manage their own. "It's not a product that's trying to own every workflow," Scott White, Anthropic's head of product for enterprise, said, according to RTÉ.

OpenAI followed. Codex gained plugins on March 26, 2026, about five months after Claude Code, according to SiliconANGLE, which reported "more than a dozen" prepackaged integrations at launch; Gigazine counted more than 20 services. On July 9, 2026, OpenAI migrated its app directory into a plugin directory where a plugin can bundle skills, apps and app templates. Microsoft's Azure SRE Agent documentation, updated on October 30, 2026, uses the same model and lists Anthropic's official catalogue among the marketplaces it can register.

Why it matters for marketers

Plugins are becoming the packaging through which advertising and commerce platforms reach agents. Amazon launched a Selling Partner plugin on September 23, 2026, in beta in the US, letting sellers check inventory, change prices and edit listings from Amazon Quick or Claude. Salesforce announced a plugin inside Claude carrying 37 prebuilt sales skills in August 2026, describing it as a plugin rather than an integration, with actions routed back through Salesforce's own business rules.

The difference from a plain connector is commercial as much as technical: a connector exposes a platform's data and actions, while a plugin also ships the vendor's playbook for using them. Meta's AI connectors for Claude and ChatGPT, opened in beta on April 29, 2026, gave agents write access to campaigns; a plugin built on such a connector can encode how those writes should be made. IAB Tech Lab's AAMP workspace on Kochava's StationOne, with 19 specialised skills across 8 functional areas running through a reference MCP server, follows the same pattern.

Markets noticed. After the Cowork legal plugin was released on January 30, 2026, software and data shares fell sharply. Implicator put the loss at $300 billion in the session of February 3, with Thomson Reuters down 16%. RTÉ, reporting on February 24, described an $830 billion selloff in software and services stocks over six trading days. The figures cover different windows; both rest on a premise, which Nvidia's Jensen Huang called illogical, that bundled prompts and connectors can substitute for subscription software.

Limitations and disputes

Security is the central objection. A plugin is executable code: hooks run shell commands, and MCP servers can read and send data. Anthropic's discovery documentation states plainly that "a plugin can run hooks and MCP servers, so read the pane before you install"; OpenAI tells Codex users to "review and trust plugin hooks before they run." Open skill registries show what happens when vetting fails. Koi Security audited 2,857 skills on ClawHub, the registry for the open-source OpenClaw agent, and found 341 malicious ones, 335 of which used fake prerequisites to install the Atomic Stealer malware on macOS, according to The Hacker News on February 2, 2026.

Supply-chain drift follows: a marketplace entry can point to a repository whose contents change after review, which version pinning reduces but does not remove.

Fragmentation persists despite shared ideas. Skills follow a common SKILL.md format published at agentskills.io, and MCP is shared across vendors, but plugin manifests, marketplace files and directory rules differ between Anthropic, OpenAI and others, so a vendor shipping to several agents maintains several packages.

Context cost and reliability are practical limits. Each enabled plugin adds descriptions the model must read, a skill helps only if the model chooses to load it, and errors cost more when a connector can write to a live ad account.

Agent skills are one component a plugin can carry: a folder of instructions and assets that teaches the model a procedure. It cannot by itself connect to a system or run on an event.

MCP servers and connectors are another component: the live link to an external service. PPC Land's connector explainer and MCP explainer cover them in detail. A plugin may contain zero, one or many.

ChatGPT plugins (2023-2024) shared the name but were single API integrations described by an OpenAPI file, closer to today's connectors than to bundles.

Extensions is the term Google's Gemini CLI uses for similar packages; it also names browser extensions, which some Codex plugins include.

Recent developments

In June 2026, OpenAI introduced role-based Codex plugins for data analytics, creative production, sales, product design, public equity investing and investment banking, together supporting 62 apps and 110 skills, according to AlternativeTo, with plugins for marketing strategy and legal work announced as planned. As of November 2026, Anthropic and OpenAI both run directories in which first-party, partner and company-private plugins sit side by side, while each company's manifest and marketplace format remains its own.

Timeline

  • March 23, 2023: OpenAI introduces ChatGPT plugins in alpha with 12 launch partners
  • April 9, 2024: Conversations with ChatGPT plugins can no longer be continued after the store, at about 1,000 plugins, gives way to GPTs
  • November 2024: Anthropic releases the Model Context Protocol
  • October 9, 2025: Claude Code plugins and marketplaces enter public beta
  • October 2025: Anthropic introduces Agent Skills
  • January 12, 2026: Anthropic launches Cowork as a research preview
  • January 30, 2026: Anthropic open-sources 11 Cowork plugins, including legal, sales, finance and marketing
  • February 2, 2026: Koi Security reports 341 malicious skills on ClawHub
  • February 3, 2026: Software stocks fall sharply after the Cowork legal plugin
  • February 24, 2026: Anthropic adds finance, HR, engineering and design plugins and company-built plugins
  • March 26, 2026: OpenAI rolls out plugins in Codex
  • June 2026: OpenAI launches role-based Codex plugins covering 62 apps and 110 skills
  • July 9, 2026: OpenAI migrates its app directory into a plugin directory
  • August 26, 2026: Salesforce announces a Claude plugin with 37 sales skills for pilot customers
  • September 23, 2026: Amazon launches the Selling Partner plugin in US beta
  • October 30, 2026: Microsoft documents a plugin marketplace for Azure SRE Agent

Summary

Who: Anthropic introduced the current format for Claude Code and Cowork; OpenAI adopted it for Codex and ChatGPT; vendors including Salesforce, Amazon, LSEG and FactSet publish plugins, and companies run private marketplaces for their staff.

What: An installable bundle that adds skills, MCP connectors, slash commands, sub-agents and hooks to an AI agent in one step, described by a manifest and distributed through marketplace catalogues.

When: The name dates from ChatGPT plugins in March 2023, retired in April 2024; the bundle format entered public beta in Claude Code on October 9, 2025, reached Cowork on January 30, 2026, and Codex on March 26, 2026.

Where: Inside agent products on desktops, terminals and the web, with catalogues typically hosted as GitHub repositories or in vendor-run directories.

Why: Agents need job-specific configuration to be useful, and plugins make that configuration portable and shareable, at the cost of security exposure from running third-party code and continuing fragmentation between vendors' formats.