Agent add-ons - the plugins and skills you install into an AI agent - are effectively applications, and enterprises overwhelmingly install them from open community marketplaces rather than a vetted, enterprise-grade one. The agent runs with the full capabilities of the employee operating it: the same access to sensitive data, internal systems, and production environments. Plugins inherit those permissions by default. A malicious plugin therefore does not need to escalate anything: it achieves fu...