Claude Marketplace Opens 2,000 Plugins Into the Agent That Already Holds Your Credentials

Note: Claude Marketplace went live on September 23, 2026 — five days old as of this writing. The plugin plumbing and the admin controls it sits on top of are older: Anthropic’s release notes put “a new plugin marketplace and admin controls for Team and Enterprise plans” at February 24, 2026. That gap matters, and we’ll come back to it, because the governance layer was built for a handful of first-party integrations and is now the front door to a catalog two thousand entries deep.

There is a person in your shop who is about to solve a real problem in under ninety seconds, and it is going to cost you more than the problem did.

Here’s the shape of it. Somebody on your team — the one who is good with computers, the one everybody asks, the one who set up the scanner — is trying to get Claude to pull order numbers out of your inventory tool instead of copy-pasting them. On Tuesday that was a scripting job nobody had time for. As of last week there is a catalog with a search box in it, and a connector for the thing they want, and a button that says install. They click it. It works. They tell you at lunch, and you are genuinely pleased, because it does work and it saved them an hour.

What also happened is this: the same model instance that holds your Google Workspace token, your repository access, your customer email thread, and whatever you pasted into a chat three weeks ago and forgot about, now has an outbound path to a third party. Not a dangerous third party, necessarily. A third party whose review process nobody has published. A third party your bookkeeper has never seen an invoice from, because the purchase — if there was one — may have come out of money you already committed to Anthropic.

That’s the story. Not “marketplaces are bad.” Marketplaces are how this technology becomes usable by people who don’t write code, and that is genuinely the point. The story is that the distribution got fast before the governance did, and for a small operation the gap between those two speeds is exactly where the incident lives.

What actually shipped on September 23, and what conspicuously didn’t

The launch is straightforward. Anthropic opened a single catalog — Claude Marketplace — organized into three sections:

1. Connectors and plugins. More than 2,000 of them at launch, with integrations from Atlassian, Google, Microsoft, Notion, and Salesforce named up front.
2. Agents and products. Claude-powered software sold by other companies: CrowdStrike, Cursor, Harvey, Hebbia, Legora, Lovable, Snowflake.
3. Service partners. Systems integrators and consultancies — Accenture, Boston Consulting Group, Deloitte — for organizations that want somebody else to do the deployment.

The stated goal is unremarkable and honest: make it easier for teams to find things that already work with Claude, and give builders a direct route to customers who are already paying for Claude. Every platform that has ever gotten big has done exactly this, in about this order.

Three things about the launch are worth writing down, because they’re the ones that change what you should do on Monday.

It’s open submission, not curated partnership. Developers build connectors and plugins using the Model Context Protocol and Agent Skills — both standards Anthropic published — and then submit them through the documented process. Companies with a Claude-powered product apply for a listing. This is not a walled garden of fifty vetted enterprise vendors. It’s a submission queue.

Purchases can draw down committed spend. Partner products can be covered by money an organization has already committed to Anthropic. If you have a commercial contract with a spend commitment, buying third-party software from the catalog may not look like a new vendor to your finance process. It may look like using up a budget line that was already approved last quarter.

Nobody has published the review criteria. As of this writing, Anthropic has not detailed how submitted connectors and plugins are reviewed, what disqualifies one, or how long approval takes. That is not an accusation of negligence — new marketplaces routinely ship before the trust-and-safety documentation does, and Anthropic’s track record on publishing its own failure modes is better than most of its competitors’. But “unpublished” and “absent” are indistinguishable from where you’re sitting, and you have to plan against the version you can verify.

”Connector,” “plugin,” “skill” — three words, three completely different amounts of trust

This is the part that gets skipped in every roundup, and it’s the part that determines whether a bad install is an annoyance or a breach.

A connector is, at its simplest, an authenticated pipe to an outside service. You grant it a scope — read my calendar, read and write this Drive folder, search this ticket queue — and it moves data across that boundary on request. The risk model is the risk model of OAuth, which every operator has already internalized badly: the scope you approved in a hurry three months ago is still live, and it’s broader than the thing you actually wanted.

A plugin is the packaging, and that is the part worth sitting with. It’s the unit of distribution — the thing the catalog lists, the thing the button installs — not a capability with a fixed risk profile. A plugin can be a thin wrapper around a connector, in which case its risk is the connector’s risk. It can bundle one or more skills, in which case its risk is whatever those skills do. It can be both. Which means “we installed a plugin” is a sentence that tells you essentially nothing about your exposure — and it is the only sentence anybody on your team is ever going to say. The word is a shipping container. You have to open it to find out whether what’s inside is a pipe or a program.

An Agent Skill is the one people underestimate. Anthropic’s own engineering write-up describes a skill as a directory built around a SKILL.md file — YAML metadata, then organized folders of instructions, scripts, and resources. It loads progressively: the metadata at startup, the full instructions when the model judges them relevant, bundled files only when needed. And crucially: “Skills can also include code for Claude to execute as tools at its discretion.” The documented example is a PDF skill that bundles Python scripts so the model can pull form fields without dragging the whole document into context. That’s a good design. It’s also a description of third-party code executing in your environment at a model’s discretion.

Anthropic says so plainly, in its own docs, before any marketplace existed: malicious skills “may introduce vulnerabilities in the environment where they’re used or direct Claude to exfiltrate data and take unintended actions.” The recommendation is equally plain — install skills only from trusted sources, and when the source is less trusted, “thoroughly audit it before use,” including file contents, code dependencies, bundled resources, and any instruction that tells Claude to reach out to an external service.

Read those two facts next to each other. The vendor’s engineering guidance is audit untrusted skills before use. The vendor’s new distribution surface is two thousand-plus listings, open submission, review process unpublished. Both can be true and reasonable. But the first one is a job, and the marketplace just made the job bigger without making it easier, and in a four-person shop nobody has been assigned that job yet.

Held side by side, the asymmetry is easier to see than to describe:

That bottom row is the load-bearing one, and it’s also the limit of everything in the next section: the admin controls operate on plugins. A plugin is the one item on this list whose risk you cannot read off its name, which means the control surface is precise about the thing you can’t evaluate and silent about the two things you can.

We made a version of this argument three weeks ago about a different vendor’s plugin auto-update behavior in the Plugin4Shell writeup, and the general principle has not moved: a plugin is a software install wearing the costume of a settings toggle. What’s new this week is scale and merchandising.

The admin controls are four dropdown states, and none of them says “approve this one”

Team and Enterprise admins do have real controls. They’re worth knowing exactly, because the gap between what they do and what people assume they do is where policy fails.

Per Anthropic’s support documentation, an admin sets an installation preference per plugin, choosing one of four states:

Enterprise admins can additionally override the org-wide preference for specific groups, so the design team and the finance team can live with different sets. Members can’t edit organization-managed plugins, which prevents two people fighting over shared tooling.

Now the limits, which the documentation does not hide but also does not advertise:

• There is no per-plugin approval workflow. Nobody files a request that an admin approves or denies. Distribution is entirely expressed through those four states, set in advance.
• There is no per-plugin permission audit view described — no single screen that tells you “these eleven installed plugins currently hold these twenty-three data scopes.”
• Control is org-wide or group-wide, not per-user.

So the honest reading of the control surface is: it’s an allowlist/denylist with a visibility switch, and it works, but only to the exact extent that somebody sits down and enumerates in advance. If nobody does that, the effective policy is “Available to install,” which means the effective policy is “whoever is curious.”

That is a policy, by the way. It’s just not the one you’d have chosen. We wrote a whole piece on this failure mode — your agent’s sandbox is a policy, not a wall — and the marketplace is the same lesson with a nicer storefront.

The committed-spend button is the part your bookkeeper should see

Here’s the mechanic that almost nobody is talking about, and it’s the most operationally interesting thing in the launch.

Organizations with a committed Anthropic contract can put a portion of that commitment toward marketplace purchases. Framed as a feature, that’s obviously good: you’ve already negotiated a budget, and now the budget is useful for more than tokens.

Framed as a procurement control, it’s a bypass. Think about how a new software vendor normally enters a small business. Somebody wants it. Somebody asks about money. There’s a conversation, maybe a look at the terms, maybe a question about where the data goes, and — critically — a new line item appears somewhere a human reads. That line item is the last honest checkpoint most small shops have. It’s not a security review, but it’s a moment when a second person finds out.

Draw the purchase against an existing commitment and the line item can disappear into a drawdown. The second person doesn’t find out. There’s no new card charge to notice in the statement, no renewal email in January to trip over.

What’s publicly stated is thin. The portion of committed spend that can be applied has not been published, and we’re not going to invent a number. The mechanics of how a drawdown appears against the commitment aren’t documented either. Two concrete asks, then, both of which take one email:

1. Ask your Anthropic account contact, in writing, what share of your commitment is eligible for marketplace purchases and whether an admin or any member can initiate one.
2. Ask whoever does your books to tell you what a marketplace drawdown looks like on the invoice, and to flag any that appear.

If you don’t have a committed contract — most 3-10 person shops don’t; you’re on Team or on Pro seats — this section is a “later” problem. File it anyway. The commitment sales motion reaches small teams faster than people expect, usually right after a good quarter.

What a 3-10 person shop should actually do this week

Not a maturity model. Four things, in order, in about ninety minutes total.

1. Decide who can install. (20 minutes)

The single highest-value thing available to you is switching the org default from “Available to install” to “Not available,” then adding back the specific plugins you already use and trust as “Installed by default.” This is unglamorous and it eliminates the entire category of curious-Tuesday-afternoon installs.

If you’re on a plan without admin controls, the control is social instead: one named person installs connectors, and it is not whoever is most enthusiastic. Write the name down where people can see it. An unwritten rule isn’t one.

2. Enumerate what’s already connected, and read the scopes. (30 minutes)

Open your connector list. For each one, write two columns in a sheet: what data it can reach, and who set it up. You will find at least one you don’t remember approving, and at least one whose scope is broader than the task — a Drive connector with write access to everything when it only needs one folder, a repo token with more than read.

Revoke on the spot, re-grant narrow. The re-grant is the part people skip because the narrow version takes six extra minutes.

3. Separate “connector” from “skill with scripts” in your head and in your list. (15 minutes)

Mark every installed item with one of two tags: pipe or code. A pipe moves data under a scope you granted. Code runs. Anthropic’s own audit guidance applies to the second category with a lot more force, and if you only have the appetite to audit a few things, audit those.

For the code ones, the audit is not mystical. Read the SKILL.md. Read the scripts. Look specifically for network calls to hosts that aren’t the vendor’s, and for instructions telling the model to fetch external content — the second one is how prompt injection gets delivered through a package you installed on purpose.

4. Give the agent somewhere to fail. (25 minutes, and it lasts)

The structural fix outlives any individual plugin review: the box running agent work with third-party extensions should not be the box holding your accounting file and your only copy of the customer list. We’ve laid out the cheap versions of this in the mini-PC sandbox piece and, for the network side, isolating agent traffic behind a separate router. Neither costs much. Both convert “a bad plugin reached everything” into “a bad plugin reached one segment.”

A trust ladder that survives Monday

The four admin states map onto a judgment you have to make anyway. Here’s the version we’d actually use:

Most of the two thousand are tier 3 and tier 4. That’s not a criticism of the catalog — it’s what open submission means, and the long tail is where the genuinely useful niche stuff lives. It’s just that the long tail is also where a small shop has the least ability to absorb a mistake. The blast-radius checklist is the right frame: don’t ask whether a plugin is trustworthy, ask what it reaches if it isn’t.

When this doesn’t apply, and when to stop worrying about it

If your Claude usage is one person drafting copy and summarizing PDFs with no connectors attached, none of this is your problem this week. Don’t build a governance process for a risk you don’t have. Skim it, install nothing, move on.

If you’re already running agents against live systems — a repo, an inventory database, a mailbox that receives customer messages — then the marketplace hasn’t created a new risk so much as it has multiplied an existing one, and the enumeration step in section 2 is worth doing today whether or not you ever open the catalog.

And if you’re about to conclude that the safe move is to ban the whole thing: that usually fails inside a month. People who have a problem and a tool that solves it will route around the ban, and they’ll do it on a personal account where you can’t see it at all. Shadow AI is worse than governed AI. “One named installer, narrow scopes, code gets read” beats “no” because people will actually follow it.

The honest summary is that this was always coming, the plumbing is good, the standards are open, and the merchandising arrived a few months ahead of the controls. That’s a normal place for a platform to be five days after launch. It’s just not a place to stand in with production credentials and no list.

Sources

5 refs

1. Anthropic — Equipping agents for the real world with Agent Skills — skill structure (SKILL.md, progressive disclosure), the statement that skills can include code for Claude to execute at its discretion, and the explicit warning that malicious skills may introduce vulnerabilities or direct Claude to exfiltrate data, with the recommendation to audit untrusted skills before use.anthropic.com
2. Anthropic Support — Manage plugins for your organization — the four installation-preference states (Required, Installed by default, Available to install, Not available), Enterprise group-level overrides, and the fact that members cannot edit organization-managed plugins.support.claude.com
3. Anthropic Support — Claude release notes — the February 24, 2026 entry launching the plugin marketplace and admin controls for Team and Enterprise plans, used for the freshness blip above.support.claude.com
4. BleepingComputer — Anthropic turns Claude into an AI marketplace with 2,000+ plugins and connectors — the 2,000+ figure, named launch partners, MCP and Agent Skills as the build route, and the open-publication model.bleepingcomputer.com
5. gHacks — Anthropic launches Claude Marketplace with more than 2,000 connectors and plugins — the September 23, 2026 launch date, the three-section catalog structure, the three submission routes, the note that review and approval details are unpublished, and the statement that partner products can be covered by spend already committed to Anthropic.ghacks.net