Skip to content
NewsProduct launch

Anthropic hands Agent Skills to the Agentic AI Foundation as a report flags 969 malicious skills

· by Pondero Newsdesk

The short version

Anthropic donated its Agent Skills standard to the Agentic AI Foundation on October 22, 2026, the same week a JFrog security report counted 969 malicious skills already circulating with high-impact payloads.

Anthropic hands Agent Skills to the Agentic AI Foundation as a report flags 969 malicious skills

Anthropic gave up control of Agent Skills, the SKILL.md format now built into more than 70 agent platforms, on October 22, 2026, per the company's announcement, the same week a supply-chain security report counted nearly 1,000 malicious skills already carrying harmful payloads.

What Anthropic actually handed over

Anthropic built Agent Skills while working on Claude Code: a folder containing a SKILL.md file that teaches an agent a specific task or domain, plus whatever scripts or reference material the job needs, per Anthropic. The company says it shipped the feature in October 2025, watched developers post thousands of skills on GitHub within weeks, and published the format as an open standard that December. It now counts 1 million skills published and nearly 280 million installed, per Anthropic's own figures, across platforms that include ChatGPT, Cursor, GitHub Copilot, and VS Code.

The October 22 donation transfers the Agent Skills name and logo, its GitHub organization, and the agentskills.io domain to the Agentic AI Foundation (AAIF), the Linux Foundation body Anthropic co-founded with Block and OpenAI in December 2025 when it donated the Model Context Protocol (MCP), per the Linux Foundation's announcement. Engineers from Anthropic, Google, OpenAI, and other companies will maintain the standard as individuals going forward, with David Soria Parra and Mahesh Murag named as lead maintainers. Developers can keep using or contributing to Agent Skills without joining the AAIF.

Agent Skills did not arrive at the foundation alone. The Linux Foundation announced it alongside three other contributions on the same day: OpenAI's Open Responses, an interoperable multi-provider LLM interface spec; Hugging Face's OpenEnv, for agent training and evaluation; and Alibaba's OpenSandbox, for secure agent execution. Together they bring the AAIF to 10 hosted projects in its first year, up from the three it launched with in December 2025 (MCP, Block's goose, and OpenAI's AGENTS.md), alongside the Agent2Agent protocol, Agent Router, and agentgateway added since. "A year ago, AAIF launched with three projects and a bet that agentic AI needed a neutral home to thrive. Today we host 10," said Manik Surtani, the foundation's CTO and co-founder, in the Linux Foundation's release.

Governance moved to a neutral body before security guidance existed

Anthropic's own proposed roadmap for Agent Skills, laid out in the same announcement, starts with versioned releases, a formal specification-change process, and security guidance for people who write and install skills. None of that guidance exists yet; it is a proposal Anthropic says it wants the community to weigh in on through the project's Discord, not a shipped control.

That gap is not theoretical. JFrog's 2026 Software Supply Chain Security State of the Union report, published October 21, 2026, one day before the donation, tracked malicious AI agent skills already in circulation and identified 969 carrying high-impact payloads, alongside 495 malicious AI models it found on Hugging Face, per JFrog's release. An agent loads a skill's name and description at startup and only reads the full instructions once a task matches it, which is exactly the mechanism that makes skills portable across platforms and the mechanism a malicious payload can ride on if nobody is scanning what gets installed. For an operator pulling skills from a public directory today, the honest state of play is: the format just changed hands to a vendor-neutral foundation, but the security review process for what gets published under that format has not shipped. Treat third-party skills as unaudited supply chain until the roadmap's security guidance actually lands, not once Anthropic merely proposes it.

Context and reactions

The donation follows a pattern Anthropic set with MCP less than a year earlier: build something inside Claude, watch it spread past Anthropic's own products, then hand governance to a foundation once no single vendor can credibly claim neutral control. David Soria Parra, who also led MCP's donation, framed it that way directly in the Linux Foundation's release: "We launched Agent Skills a year ago to give developers and enterprises alike an open standard to make their agents more capable. Today, we're donating Agent Skills to the AAIF to ensure that anyone building with skills can shape what's next."

The foundation itself grew alongside the project news. In a separate release the same week, the AAIF said it added 7 new Gold members, 33 Silver members, and 18 Associate members over the past quarter, bringing total membership to 305 organizations, per the Linux Foundation. New members include a global philanthropy and a major Canadian bank alongside security and AI-governance firms. "When financial institutions and philanthropies are working alongside security startups and data companies, agents are no longer a developer experiment," said Mazin Gilbert, the AAIF's executive director, in that release. "They're becoming institutional infrastructure."

Both announcements timed to AGNTCon + MCPCon North America, the Linux Foundation's agentic-AI conference running October 22-23 in San Jose, where the foundation used its own growth, four new projects and 305 members, as the headline case for vendor-neutral governance over a space four different companies are now routing their standards through rather than controlling outright.

What to watch next

Anthropic has not set a date for the promised security-guidance proposal, and JFrog's count of malicious skills was taken before that guidance existed, so the next real test is whether the AAIF ships a review or signing process before the installed base (already near 280 million, per Anthropic) grows further. Watch the project's Discord for the first formal specification-change proposals, and watch whether platforms still outside the 70-plus already using Agent Skills, including any that have stayed with closed-loop tool systems, adopt the now vendor-neutral format over the next few months.

Sources