Agent Skills Move to the Linux Foundation's AAIF: What Security Teams Should Take From It

What was announced

On 22 October 2026 Anthropic announced that it is donating the Agent Skills standard to the Agentic AI Foundation (AAIF), which sits under the Linux Foundation. Anthropic says it is "committed to keeping Agent Skills open, community-driven, and vendor-neutral".

AAIF is not a new home for Anthropic's work. Anthropic says it co-founded the foundation last year with Block and OpenAI, and that it previously donated the Model Context Protocol (MCP) to it. Agent Skills now joins MCP under the same governance.

Simon Willison, whose link-blog post surfaced the news, notes that he had suggested this outcome in December 2025. At that point Anthropic had just declared skills an "open standard". He wrote then that he wouldn't be surprised to see the standard end up in the AAIF.

Why it matters beyond governance

For most organisations the practical effect is predictability. A standard with neutral stewardship is less likely to change direction to suit one vendor, and tooling built against it is less likely to be stranded. That is a real procurement and architecture benefit for teams standardising on agent tooling.

It also has a consequence our readers should plan for. Open, widely adopted extension standards tend to grow ecosystems of shared third-party components. The announcement itself says nothing about security controls, and we are not claiming any weakness in the standard. The point is about the pattern: once capabilities are packaged and shared, they behave like any other dependency.

Treat agent extensions as third-party code and content

Governance bodies set specifications. They do not vet every component built on them. A security programme should therefore assume that whatever an agent loads, whether a skill or an MCP server, is an input to a system that can read data and take actions.

• Inventory: keep a record of which skills and MCP servers are enabled, where each came from, and who approved it.
• Review before adoption: read the content of an extension as you would a dependency, and pin versions so updates are a deliberate change.
• Least privilege: scope the tools, credentials and data an agent can reach, so a misbehaving or manipulated extension has limited blast radius.
• Test the agent, not just the code: include prompt injection and tool-misuse scenarios in AI red-team exercises, because the risk sits in how the model acts on what it loads.
• Map to governance: record extension controls in your AI management system, for example under ISO 42001, alongside your existing supply-chain policy.

What to watch next

Standards bodies often add provenance, signing or review conventions as ecosystems mature. We would watch whether AAIF's stewardship of both MCP and Agent Skills leads to shared guidance on how extensions are published and verified. Until that exists, the controls above are your own responsibility.