The Product Desk

The mechanism is simple, which is why it matters

Air, a Sequoia-backed security startup, shared the research exclusively with The Information. All four agents — Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI and Microsoft's GitHub Copilot — scan a third-party skill for malicious code at download time. Once a skill passes, the agent installs later updates from that creator automatically. Republish under the same name with intellectual-property exfiltration code, and it installs silently: no change detection, no user alert. The full path is upload something genuinely useful to a public marketplace, wait for adoption, then swap the payload.

Air's founder Niv Hoffman put the transferable part plainly:

"Four different engineers in four different companies made the same exact logical mistake, and this mistake was in how they built their verification mechanism."

Read that as a product finding, not a security headline. When four independent teams converge on one defect, the defect lives in the shared mental model of how extensible agent systems work: verify by name, trust on first use, auto-update forever. If your product ships a template gallery, a connector library, a skills marketplace or a plugin surface, you built on that model too.

Remediation is uneven and the gap is named

Anthropic, OpenAI and Google patched after Air's June 2026 disclosure. Microsoft has not confirmed a patch for GitHub Copilot months later; GitHub declined direct comment and pointed to a registry-level control that blocks same-name reuploads of different software. That control does not cover skills sourced outside GitHub repositories — which is where many third-party skills actually live. Air reports no evidence of exploitation before its report. That is thin comfort: the flaw is public now and the attack requires no novel technique.

The same failure, one layer up

Forever Security demonstrated that a single ordinary browser extension can take control of the AI assistants embedded in Gemini Live in Chrome, Perplexity Comet, Microsoft Edge's assistant, Opera Neon and Claude. Five vendors, five engineering orgs, one technique. Both findings say the same thing: teams shipped assistants and extension surfaces faster than they adapted the trust boundary underneath, and the browser sandbox was never designed for an agent acting inside an authenticated session.

The surface is about to widen on purpose. MCP now defines a standard way for agents to discover and lazily load Agent Skills — SKILL.md files, references, scripts and examples — served through its existing Resources primitive. No new protocol core means cheap, fast adoption. It also means runtime ingestion of third-party instructions becomes a designed-in path, not an accident.

What actually changes in your rubric

Delete "most secure" from your vendor evaluation. Anthropic's safety-first positioning, OpenAI's security org scale, Google's hyperscaler infrastructure and Microsoft's enterprise trust incumbency all failed to insulate anyone here. The only axis vendors can still differentiate on is time-to-patch and disclosure transparency — which is precisely where one of them is currently the outlier.

Then note the commercial gap. There is no enterprise control plane for employee-installed agent skills: no allowlist, no org registry, no update diff, no admin alert. AI security consultant Ken Huang framed the mismatch better than any vendor will: warnings about frontier-model risk in the next six to twelve months may be overhyped, but "the security issues with these AI agents are in many ways underhyped." Enterprises already understand this pattern from browser extensions and third-party app policies. You are filling a gap they can name.

What shipped alongside the deletion

Someone on the team opens the message box, sees separate Chat and Cowork options, and concludes the update failed. It has not arrived yet. Anthropic is ramping this account by account, which is the cheapest way to catch a bad default before it reaches everyone. The cost is a couple of weeks of one team running two different products. Existing chats, projects, artifacts, connectors and skills carry over with nothing to switch on.

What shipped on top matters more than the merge. Anthropic pushed Artifacts into dedicated Claude Docs and Claude Slides in beta, moved Claude Design into conversations, and added one shareable link with direct colleague editing plus export to Word, PowerPoint and PDF. Shareable links, colleague editing and Office export put this in the Microsoft 365 and Google Workspace output lane, not the assistant lane. Standalone AI document and deck generation now competes with a feature living inside the conversation users already have open.

The economics of making it the default

Anthropic gated the merged experience to Pro and Max first, with lower tiers to follow. Gating it that way prices the agentic mode as a retention feature instead of acquisition bait, and the packaging instinct is worth copying for anything compute-heavy. The tradeoff ships in the same box. Background, long-running work as the default instead of opt-in inflates per-user inference on a fixed-price plan by construction. The exits are usage caps announced later, which users experience as a takeaway, or a price increase.

Databricks already ran this experiment on itself

Patrick Wendell disclosed what happened when GPT-6 Astra went to every engineer, roughly 3,500 of them, up from a 200-person pilot. Total coding spend rose about 60%, and the company created a dedicated Astra sub-budget to force selective use. His caveat is the product finding: Astra unambiguously wins on high-level system design and long-range tasks and may not materially improve medium or low-complexity coding. Arena prices that curve. Astra Max buys +11.7% quality at $3.94 a task against Sol xHigh at +7.0% for $1.03. Fable 5.1 Max buys +13.7% for $4.40 against Opus 5 High at +10.2% for $2.07.

Context trimming is cheaper than any tier swap, and almost nobody mentions it. A protocol-aware retention result reports 96.0% task success preserved while saving 56% of tokens, and Arena found that a model's native harness matters less than many assume across 21 model-harness pairs. A 56% token cut moves margin further than a tier downgrade, and it requires no vendor negotiation.

Where the sources diverge, and the counter-position

Reads on the release split on one detail that decides positioning. One framing says mode selection is gone entirely and the model routes. Another says users keep exactly one control, a cap on how much Claude does before checking in. No account mentions a user-facing routing override, so a competitor can ship one and claim the difference.

Auto-route by default, keep a visible override, and show the user what the task cost. Anthropic just validated the first half and left the other two open.

Sequence it in that order. Delete the toggle, then ship the escape hatch and the meter in the same release. The meter is what surfaces a spend increase on the scale of Databricks' 60% while there is still time to write a sub-budget instead of a cap announcement.

The pipeline that produces the eval

A PM prototypes on today's model, lists every failure from the afternoon, and turns all of them into evals. Most of that list was prompt hygiene. The triage matters more than the number 20. Sort each failure into two buckets: fixable with a system instruction or better prompting, versus fundamental to the model. Only the second bucket becomes an eval.

The claim underneath comes from Tulsee Doshi on Nikhyl Singhal's Inside PM series. No customer hands the model team a requirements document. The team decides what the model should get better at, then describes it precisely enough for researchers to build toward. Researchers can improve anything you can measure, so the bottleneck sits at definition rather than implementation, which inverts the classic PM value chain. "Make the information architecture better" aligns nobody. Twenty prompts where a win and a loss are obvious align a room instantly.

Two caveats she flags. The best evals in the industry took days and weeks to build. The harder part is choosing which of many possible evals to invest in, because researchers hill-climb toward whatever you point at. Choose the wrong target and they will climb it faithfully.

60/20/20, and the risk it defends against

The scoping rule is uncomfortable by design. A feature today's model fully supports was cut too shallow; one it cannot do at all was cut too aggressively. Target roughly 60% working, 20% mediocre, 20% reach. The risk being priced is anchoring, in Doshi's words: "if we try too hard with these models right now to build the perfect product today, you are going to anchor on a product that is actually maybe even too simple for the world of tomorrow."

The operational companion is NotebookLM's standing backlog of features the model cannot handle yet, retried against every new checkpoint. That team ships first when capability lands, and its upstream feedback is specific enough to influence research direction. Its ship gate is two questions: is anything fundamentally broken, and are there glimmers of light. Google's conventional launch machine of hundreds of teams flipping lights green stays intact everywhere else. The carve-out is precedent for negotiating a lighter gate on AI releases.

The same move, industrialized

Cloudflare pushed the machine-checkable spec considerably further. Engineering standards became RFCs, every SHOULD and MUST statement got a persistent identifier, the statements were extracted into structured JSON, and three agents were pointed at the software lifecycle. In four months the code reviewer flagged 230,000 violations and blocked 16,000 merges. The spec reviewer has evaluated 600-plus technical designs; the incident reviewer has assessed 200-plus postmortems since May 2026. A graduated lifecycle made 16,000 blocked merges survivable: approved and non-blocking first, local check via CLI, then enforced.

Cloudflare says the next expansion is to product, security, compliance and trust and safety teams. The spec reviewer is coming for the artifact PMs own. A machine can check a numbered requirement with a stable ID; it cannot check a paragraph of prose. Numbering the requirements in the last PRD that shipped is this week's cheap move.