This Week in Extensibility: Shopify asks app developers to run its new AI security scanner, the Model Context Protocol charters a Tasks and Events group to standardize how servers notify a user's agent, and Trigger.dev makes inbound webhooks a hosted service

2026-10-23T00:00:00-04:00

Shopify asked every developer in its App Store to run a new security scanner and previewed stricter listing rules, after hijacked apps began sending shoppers to fake checkout pages. The Model Context Protocol chartered a working group to standardize how a connected service notifies a user's agent when something changes. And Trigger.dev turned the webhooks that set off its customers' automations into a hosted service that checks each event.

Marketplace security: Shopify asks app developers to run its new AI security scanner

Shopify asked every App Store developer to scan their apps for vulnerabilities and previewed stricter rules for listing one. On October 20 the company asked all developers of public apps to run its new security check, which looks for weaknesses specific to Shopify apps, such as routes left open without authentication, code that can reach another store's data, and webhooks accepted without verifying they are genuine. Shopify also previewed platform changes it plans to make: access tokens that expire, a restriction so an app's keys work only from the developer's own servers, tighter limits on the code storefront apps may run, and a higher security bar to list in the App Store. Shopify named no breach. It attributed the push to attacks "increasing across the app ecosystem as AI gets better at finding vulnerabilities," while outside coverage tied the timing to hijacked apps that redirected shoppers to fake checkout pages. The scanner itself, which Shopify released on October 15, runs on the developer's own machine and is invoked through Shopify's AI coding assistant.

Why it matters: Salesforce scans the packages developers upload to it, and Atlassian scans the Forge apps that run on its own platform. A Shopify app runs on the developer's own servers, so Shopify never sees the code. Cloudflare shipped the same open-source, coding-assistant check in September for its own platform; Shopify is applying the approach to apps it does not host.

Standards: the Model Context Protocol charters a Tasks and Events group to standardize how servers notify a user's agent

The Model Context Protocol created a working group to standardize how a connected service runs a long task for a user's agent and how it alerts the agent when something changes. On October 20 the project chartered a Tasks and Events working group to write one standard way to do both. OpenAI already lets a user ask ChatGPT to watch a connected app, and the app sends a signed message back when its data changes.

Why it matters: a user's agent has mostly had to poll a service or ask again to learn what changed. A standard way for the service to push the change instead lets the software a person connects notify their agent on its own, so a one-time request can run as a standing automation.

Agents on the web: WebMCP defers hostile-page defense to a proposed W3C working group

WebMCP's editors merged a security section into the draft on October 20 describing risks a web page can pose to a visitor's agent. WebMCP is a draft standard that lets a web page offer tools a visitor's agent can call. The merged section covers risks such as a page feeding the agent bad instructions and a page correlating a user's data across sites. Defending against them, it says, is "primarily the responsibility of the agent's own security model rather than something this specification can normatively enforce," and it points to the proposed W3C Agentic Web Working Group as the venue for broader standardization.

Why it matters: the work of stopping a page from manipulating or tracking an agent now falls on whoever builds the agent, not on the standard. That includes a browser's built-in assistant, standalone agents, and AI browser extensions. The standard itself enforces no common defense, so how well a user is protected comes down to which agent they run.

Automation: Trigger.dev turns inbound webhooks into a hosted, verified service

Trigger.dev began hosting and verifying the inbound events that set off its customers' automations. On October 23 it shipped a release that receives events from outside services such as Stripe, GitHub, and Shopify, confirms each one is genuine, and routes it to the automation a customer has tied to it. The same release lets a customer run an automation as a chat agent inside Slack or Linear, where each thread becomes a live session. It streams replies and asks for approval before the automation acts.

Why it matters: verifying and routing an inbound event is work most automation platforms leave to the customer. Folding it into the platform shrinks what a customer has to build to connect an outside service to their own automations.

Also worth knowing

Apple opposed a Chrome proposal to let extensions switch browser tabs when a user scrolls over the tab strip. At the W3C cross-browser extension group's October 22 call, Apple preferred extending an existing Firefox control for browser behaviors to adding a new one. The group also leaned toward loading an extension with a warning rather than rejecting it over an unrecognized manifest entry.
Atlassian deprecated the product-specific way Forge apps take over a full page. Apps that fill a full page in Jira or Confluence must move to a single unified building block; Atlassian will forward the old addresses until December 18, 2026, then stop.
Microsoft let administrators choose which security certificates the Visual Studio Code coding agent's sandbox trusts and route its sign-ins through a proxy. In the October 21 release, the proxy keeps tools running inside the sandbox from ever seeing the real credentials.
Svix opened a way for vendors to manage their customers' webhook destinations in code. The webhook provider shipped a public interface that lets a company set up and configure where a customer's events are delivered programmatically rather than through a dashboard.

On the radar

October 26: The WebAssembly Component Model subgroup holds its first meeting.
October 26–30: The W3C holds its annual gathering (TPAC) in Dublin, including an October 28 session on fitting WebMCP into the browser-extension platform.
November 3: The WebAssembly Community Group will discuss how a page's Content Security Policy applies to WebAssembly.
November 5: The W3C WebExtensions Community Group holds its next call.
December 1: New Microsoft 365 Copilot Business licenses switch to usage-based billing by default.
December 18: Atlassian stops forwarding Forge's old full-page addresses; apps must migrate to the unified building block.
December 31: Bug and security fixes end for the 0.x line of Cloudflare's Sandbox SDK.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.