Coding Agents Grew a Plugin Economy: What Claude Code Mods and Cursor Projects Change

The extension surface is the new battleground

For most of 2026, the coding-agent conversation was about models: which one reasons better, which one writes cleaner diffs, which one survives a long session. October shifted the argument somewhere less glamorous. It moved to the thing agents plug into.

Over a single week in early October, GitHub's trending page filled up with repositories that were not models at all. There was cursor/plugins, a plugin specification plus a set of official plugins. There was mattpocock/skills, a grab-bag of agent skills lifted straight from one developer's .agents directory. There was michael-denyer/pstack-claude, which ports a set of rigorous agent workflows across half a dozen different harnesses. None of them generate an image or a token by themselves. All of them make the agent you already have do more.

That is the change worth paying attention to. The model is becoming a component. The extension layer is where the differentiation now lives.

What shipped in October

Two vendor moves set the tone. Anthropic shipped Claude Code Mods in version 2.1.292: a plugin architecture where plugins modify deeper behavior, not just tool calls. A mod can hook into agent.spawn to approve or refuse subagent types, cache prompt blocks for latency savings, or raise native notifications. One built-in mod even runs a side agent that watches what you or Claude might have missed. It is the first time a major terminal agent has treated itself as a platform rather than a product.

Cursor's October changelog reads like a strategy pivot. Remote Control lets local agents keep running on your machine while an iOS app connects to them. Rollouts watches every deploy, writes a monitoring plan as a PR comment, detects regressions and can open a revert PR. Security Review reads each PR in codebase context and posts one comment flagging injection holes, auth bypasses, and committed secrets. And Projects introduces a coordinator agent that does not write code at all: it plans, delegates to implementation agents, manages shared context, and runs on its own cloud computer.

Neither of these is a feature list. Both are statements about where the value is moving: from the ability to generate code, to the ability to organize the agents that generate it.

Skills, mods, plugins, and the naming mess

The vocabulary has not settled, and that is itself a useful signal. Anthropic calls them mods. The community repos call them skills. Cursor calls them plugins. They describe roughly the same idea: a packaged piece of behavior that the agent loads at runtime, that changes what the agent can do or how it behaves, and that someone other than the model vendor wrote.

The pattern is familiar from earlier platform eras. A tool ships with a small set of first-party capabilities. A community grows around it and builds the long tail. An ecosystem forms. Eventually the platform owner either embraces the ecosystem and sells access to it, or fights it and loses developer mindshare. Terminal agents are now visibly in the middle of that arc.

What makes it more than a rerun of the app-store story is the object being packaged. A plugin for a photo editor extends what the editor can draw. A mod for a coding agent extends what the agent is allowed to do, how it reasons, which subagents it may spawn, and what it refuses. You are editing a collaborator's judgment and its permissions, not merely adding a brush. That is a much stranger thing to install from a stranger's git repository.

The distribution model reinforces the point. Most of these extensions are not sold. They are copied out of someone's dotfiles, adapted, and pushed back. The unit of currency is not a licence fee but attention and trust. A plugin that ran a command you did not intend would end a maintainer's reputation faster than any code review, and the ecosystem has started to police itself accordingly. The result is a strange hybrid: an extension market with almost no market in it, held together by shared conventions and the fact that everyone can read everyone else's source.

Why the workflow ports matter more than the plugins

The repository that says the most is not the biggest one. It is the one that ports a workflow across harnesses. When a set of prompts and process rules can be translated from Claude Code to Codex to Copilot to Gemini, the workflow stops being tied to a vendor and becomes a asset you own. The agent becomes replaceable. The way you work does not.

That has an obvious commercial consequence. If your competitive advantage sits in your prompts and process, then switching model vendors is a cost decision rather than a rewrite. If it sits in a proprietary harness, switching is a migration project. Teams that have been through one vendor's deprecation cycle do not need to be told which they prefer.

A quieter cost: the trust tax

Every extension surface carries a security question, and this one is sharper than usual. A skill that can run shell commands inside your agent is running shell commands on your machine. A mod that can approve or refuse subagent spawns is making a permission decision you would otherwise make. The convenience and the risk arrive in the same package.

That is not an argument against the ecosystem. It is an argument for treating agent extensions the way you treat a dependency: pin versions, read what they do, and be suspicious of the ones that ask for more access than the job needs. The tooling is moving faster than the norms around it, which is the usual order of things and rarely a comfortable one.

What to watch next

Three things will tell you where this goes. First, whether plugin installation gets a real trust layer: signing, permission scopes, a marketplace with review. Second, whether the workflow-porting repos keep a stable audience as vendors keep shipping first-party competition. Third, whether "which agent do I use" stops being a question people ask, the way "which browser engine" mostly stopped being a question for end users.

The honest read on October is that the industry has stopped asking agents to be smarter and started asking them to be better organized. Plugins, skills, mods, and coordinator agents are all the same bet: that the hard part of useful autonomy is not intelligence, it is infrastructure. If that bet is right, the most valuable thing shipped this month is not a model. It is a place to put the pieces.

There is a risk in that framing worth naming. Infrastructure bets take longer to pay off than model bets, and they are harder to demo. A new model produces a graph that goes up and to the right. A plugin architecture produces a folder of files and a promise that the ecosystem will fill it in. The teams that win the next phase of agent tooling may be the ones patient enough to build the boring layer while everyone else is refreshing a leaderboard.