Todd Schiller - marketplace security

This Week in Extensibility: Jagex ships an official RuneScape plugin system, Anthropic ships MCP Tasks in Claude, and Obsidian starts delisting plugins that fail its automated review

2026-10-30T00:00:00-04:00

Jagex gave RuneScape its first sanctioned way to extend the game, a plugin system built into the client. On letting AI agents operate the apps people already use, Anthropic shipped MCP's Tasks feature in Claude and Cloudflare let an agent's code survive a crash and pause for a person's approval. Marketplace owners kept raising the security bar on the extensions they host: Obsidian started delisting plugins that fail its automated review, and Shopify set hard 2027 deadlines to retire app credentials that never expire.

Game modding: Jagex ships an official plugin system for RuneScape

Jagex shipped an official, in-client plugin system for RuneScape, the first sanctioned way to extend the game from inside its own client. It went live on all worlds on October 19, with an in-game hub where players browse and install community plugins. The first batch was five, including a quest helper and a tile marker, but the machinery behind them matters more. Jagex built an interface for plugins to call, added a scripting language to the client, and routes every plugin through a moderator queue and quality-assurance playtesting before it ships through the mod.io platform. Only approved, mod.io-published plugins run on live worlds; untrusted and in-development ones stay on separate developer worlds that do not touch a player's account. A plugin may not automate gameplay or grant an unfair advantage.

Why it matters: RuneScape 3 had no equivalent to the third-party overlay client that Old School RuneScape players have long used, and Jagex has kept outside clients at arm's length. Building the system into the official client lets the studio offer reviewed customization while blocking the automation it works against. The hard problem in a competitive game is separating helping a player from playing for them, and Jagex has now encoded that boundary in what the interface lets a plugin do.

Marketplace security: Shopify sets hard 2027 deadlines to retire app credentials that never expire

Shopify set hard 2027 deadlines to retire App Store credentials that never expire, and shipped the security controls it previewed last week. On October 27 it published the schedule and the controls. Starting January 1, 2027 a public app still using a non-expiring credential is delisted and blocked from new installs; on January 15 affected merchants see a warning; on April 1 the credential stops working on API calls. The controls that shipped alongside the dates go beyond last week's preview: an app must declare which outside servers and sites it talks to, developers must verify their identity before installing on a development or transfer store, and a security hub gives developers a self-check to run against their own code. The expiring-credential requirement itself dates to May; the deadlines are what is new.

Why it matters: last week's preview now has fixed dates. Hard credential expiry is a rule Shopify can enforce even though its apps run on the developers' own servers, where it never sees the code.

Plugin directories: Obsidian starts delisting plugins that fail its automated review

Obsidian began removing community plugins whose latest version fails its automated security review. The note-taking app announced in May that it would scan every version of every plugin, not just first submissions, for security problems, code-quality issues, and malware, and post the result as a public safety scorecard. It said existing plugins would eventually have to meet the bar but set no date. That enforcement takes effect on October 31, 2026: a plugin whose current release still fails is dropped from the directory and can no longer be installed from inside the app. Copies already installed keep working, and a maintainer can fix the problems and re-release.

Why it matters: passing the automated review is now a condition of staying listed, not a one-time gate at submission. A plugin runs with the app's reach into a user's notes and files, so whether it still meets the bar is part of what a user trusts when they install it.

Agents and the web: Anthropic ships MCP Tasks in Claude, and WebMCP's incubator proposes a W3C working group

Anthropic shipped MCP's new Tasks feature in Claude. Last week the MCP project chartered a group to standardize two things: how a connected service runs a long job for a user's agent, and how it tells the agent when something changes. This week Claude on the web and Claude Code gained the first half, Tasks, per the project's client support matrix (October 28). Tasks lets an agent hand a connected service a long-running job and come back later for the result, not only quick back-and-forth requests. It is still pre-stable, and the matrix lists only a few clients with support, Claude alongside the third-party MCPJam inspector. The companion half, event notifications, is still being written.

And the group incubating the draft WebMCP standard proposed handing it to a new W3C working group. WebMCP is a draft that lets a web page offer tools a visitor's agent can call. At the W3C's annual gathering in Dublin (October 26 to 28), that group proposed moving the work into an Agentic Web Working Group, whose charter is in review, and a separate session took up how WebMCP fits the browser-extension platform. The draft charter was broadened during the week to cover agent identity and delegation, not only WebMCP, and the editors merged rules for how a page can safely let an agent use its tools when embedded in another site. WebMCP still runs only behind origin trials or experiments in Chromium-based browsers like Chrome, Edge, and Brave. Firefox has only an early prototype that stays off behind hidden settings, and Mozilla's position is neutral; Safari does not implement it and Apple opposes it. So none of this makes it a capability that works across browser engines.

Why it matters: on the protocol side, an AI agent can already act inside the apps people use today, even if Tasks is pre-stable and in only a few clients. WebMCP is still one browser family's origin trial; the W3C proposal would move its design into a cross-vendor working group. Whether other browsers implement it is the open question.

Infrastructure: Cloudflare makes an agent's code survive crashes and pause for approval

Cloudflare made an agent's code able to survive a crash and pause for a person's approval. On October 26 its framework for running agent code gained two experimental abilities: a run can resume after the service is redeployed or crashes, and it can pause partway for an outside answer, for example a human approving an action, without the wait counting against the run's time limit.

Why it matters: a sandbox running an agent's code on a customer's behalf can now hold a long or risky task open for human sign-off and pick up where it left off after a failure, enough for a multi-step workflow a person would trust it with rather than a single quick action. Durable execution and human-in-the-loop pauses are established in tools like Temporal and Vercel's Workflow kit; what is new is bringing them to Cloudflare's agent-code sandbox, still experimental for now.

Also worth knowing

Minecraft shipped a new stable version of the scripting interface its Bedrock add-ons are built on. The October 27 release gives add-ons a way to read and control in-game time and its events, plus finer control over sound and experience points. Bedrock, the edition on consoles and mobile, has a large player base, and its official add-on interface is a widely used way players customize the game. The update is incremental.
MCP defined experimental, beta, and stable stages for its extensions. The new ladder, paired with a twice-yearly release schedule, sets how extensions like Tasks graduate from experimental to stable. Within days MCP applied it, reclassifying its Skills extension, a way for a connected service to offer reusable capability bundles an agent can load, to beta.
Atlassian added organization-scoped distribution for marketplace apps. Developers can now restrict a Jira or Confluence app so only members of the publisher's own Atlassian organization can install it (October 28).
The password-manager maker Dashlane documented how Chrome's extension model slows its product down. As input to a W3C Dublin discussion on the cross-browser extension platform, Dashlane detailed concrete limits of the current model (Manifest V3), including background processes that reload from scratch and cause delays a user can feel.
CopilotKit now sandboxes embedded assistant widgets by default. The toolkit for building in-app AI assistants changed its default so a third-party interface widget an assistant embeds is isolated and cannot follow links out of its sandbox.

On the radar

November 3: Google releases Chrome 157 to everyone, and the WebAssembly Community Group discusses how a web page's content security policy applies to WebAssembly.
November 5: The W3C's cross-browser extensions group holds its next call.
November 9: The WebAssembly Component Model group holds its second meeting.
Mid-to-late November: The W3C posts minutes from its Dublin meeting, including the sessions on WebMCP and the browser-extension platform.
December 1: New Microsoft 365 Copilot Business licenses switch to usage-based billing by default.
December 18: Atlassian stops forwarding Forge's old full-page addresses; apps must move to the unified building block.
December 31: Cloudflare ends bug and security fixes for the 0.x line of its Sandbox SDK.
January 1, 2027: Shopify delists public apps still using access credentials that never expire.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.

This Week in Extensibility: Shopify asks app developers to run its new AI security scanner, the Model Context Protocol charters a Tasks and Events group to standardize how servers notify a user's agent, and Trigger.dev makes inbound webhooks a hosted service

2026-10-23T00:00:00-04:00

Shopify asked every developer in its App Store to run a new security scanner and previewed stricter listing rules, after hijacked apps began sending shoppers to fake checkout pages. The Model Context Protocol chartered a working group to standardize how a connected service notifies a user's agent when something changes. And Trigger.dev turned the webhooks that set off its customers' automations into a hosted service that checks each event.

Marketplace security: Shopify asks app developers to run its new AI security scanner

Shopify asked every App Store developer to scan their apps for vulnerabilities and previewed stricter rules for listing one. On October 20 the company asked all developers of public apps to run its new security check, which looks for weaknesses specific to Shopify apps, such as routes left open without authentication, code that can reach another store's data, and webhooks accepted without verifying they are genuine. Shopify also previewed platform changes it plans to make: access tokens that expire, a restriction so an app's keys work only from the developer's own servers, tighter limits on the code storefront apps may run, and a higher security bar to list in the App Store. Shopify named no breach. It attributed the push to attacks "increasing across the app ecosystem as AI gets better at finding vulnerabilities," while outside coverage tied the timing to hijacked apps that redirected shoppers to fake checkout pages. The scanner itself, which Shopify released on October 15, runs on the developer's own machine and is invoked through Shopify's AI coding assistant.

Why it matters: Salesforce scans the packages developers upload to it, and Atlassian scans the Forge apps that run on its own platform. A Shopify app runs on the developer's own servers, so Shopify never sees the code. Cloudflare shipped the same open-source, coding-assistant check in September for its own platform; Shopify is applying the approach to apps it does not host.

Standards: the Model Context Protocol charters a Tasks and Events group to standardize how servers notify a user's agent

The Model Context Protocol created a working group to standardize how a connected service runs a long task for a user's agent and how it alerts the agent when something changes. On October 20 the project chartered a Tasks and Events working group to write one standard way to do both. OpenAI already lets a user ask ChatGPT to watch a connected app, and the app sends a signed message back when its data changes.

Why it matters: a user's agent has mostly had to poll a service or ask again to learn what changed. A standard way for the service to push the change instead lets the software a person connects notify their agent on its own, so a one-time request can run as a standing automation.

Agents on the web: WebMCP defers hostile-page defense to a proposed W3C working group

WebMCP's editors merged a security section into the draft on October 20 describing risks a web page can pose to a visitor's agent. WebMCP is a draft standard that lets a web page offer tools a visitor's agent can call. The merged section covers risks such as a page feeding the agent bad instructions and a page correlating a user's data across sites. Defending against them, it says, is "primarily the responsibility of the agent's own security model rather than something this specification can normatively enforce," and it points to the proposed W3C Agentic Web Working Group as the venue for broader standardization.

Why it matters: the work of stopping a page from manipulating or tracking an agent now falls on whoever builds the agent, not on the standard. That includes a browser's built-in assistant, standalone agents, and AI browser extensions. The standard itself enforces no common defense, so how well a user is protected comes down to which agent they run.

Automation: Trigger.dev turns inbound webhooks into a hosted, verified service

Trigger.dev began hosting and verifying the inbound events that set off its customers' automations. On October 23 it shipped a release that receives events from outside services such as Stripe, GitHub, and Shopify, confirms each one is genuine, and routes it to the automation a customer has tied to it. The same release lets a customer run an automation as a chat agent inside Slack or Linear, where each thread becomes a live session. It streams replies and asks for approval before the automation acts.

Why it matters: verifying and routing an inbound event is work most automation platforms leave to the customer. Folding it into the platform shrinks what a customer has to build to connect an outside service to their own automations.

Also worth knowing

Apple opposed a Chrome proposal to let extensions switch browser tabs when a user scrolls over the tab strip. At the W3C cross-browser extension group's October 22 call, Apple preferred extending an existing Firefox control for browser behaviors to adding a new one. The group also leaned toward loading an extension with a warning rather than rejecting it over an unrecognized manifest entry.
Atlassian deprecated the product-specific way Forge apps take over a full page. Apps that fill a full page in Jira or Confluence must move to a single unified building block; Atlassian will forward the old addresses until December 18, 2026, then stop.
Microsoft let administrators choose which security certificates the Visual Studio Code coding agent's sandbox trusts and route its sign-ins through a proxy. In the October 21 release, the proxy keeps tools running inside the sandbox from ever seeing the real credentials.
Svix opened a way for vendors to manage their customers' webhook destinations in code. The webhook provider shipped a public interface that lets a company set up and configure where a customer's events are delivered programmatically rather than through a dashboard.

On the radar

October 26: The WebAssembly Component Model subgroup holds its first meeting.
October 26–30: The W3C holds its annual gathering (TPAC) in Dublin, including an October 28 session on fitting WebMCP into the browser-extension platform.
November 3: The WebAssembly Community Group will discuss how a page's Content Security Policy applies to WebAssembly.
November 5: The W3C WebExtensions Community Group holds its next call.
December 1: New Microsoft 365 Copilot Business licenses switch to usage-based billing by default.
December 18: Atlassian stops forwarding Forge's old full-page addresses; apps must migrate to the unified building block.
December 31: Bug and security fixes end for the 0.x line of Cloudflare's Sandbox SDK.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.