The Takeover Checklist
Who Lets the Agent Press That Button

On January 12, 2026, Anthropic launched Cowork—a desktop agent designed to bring the "plan, execute, iterate" capabilities of Claude Code to people who don't write code. Eighteen days later, on January 30, Anthropic open-sourced 11 plugins on GitHub: calendar management, document retrieval, sales, financial analysis, data query and visualization, legal review and compliance, marketing, customer service, product management, bio research, plus a plugin specifically "for creating and customizing new plugins." The entire content of these plugins was a set of Markdown and JSON files.

Anthropic product lead Matt Piccolella, in an interview with TechCrunch, defined the word "plugin" quite bluntly:

The market did not take this statement as marketing copy. Four days later, on February 3, Anthropic officially released the legal plugin—contract review, NDA triage, compliance workflows, legal briefs, configurable per a company's own playbook. Thomson Reuters fell as much as 18% intraday, its largest single-day decline on record; RELX (LexisNexis parent) fell 14%, its largest single-day decline since 1988; Wolters Kluwer fell 13%, LegalZoom dropped nearly 20%, FactSet fell over 10%. Within four days, the S&P Software Services Index plunged 4% in a single day, wiping out over $285 billion in market cap, and the JPMorgan Software Index fell 7%. Jefferies strategist Jeffrey Favuzza named the crash SaaSpocalypse.

From January 12 to February 23, the S&P Software Services Index—whose constituents include Microsoft, Oracle, Salesforce, Workday—fell roughly 25% before stabilizing. A CNBC follow-up in April cited analysts saying that since Anthropic's valuation was still only $18 billion in January 2025, the SaaS sector had cumulatively evaporated $1.4 trillion in market cap.

But this is not a one-directional replacement story. On February 24, when Anthropic further expanded its enterprise agent program, the partner list included FactSet, S&P Global, and LSEG—the very companies whose stock it had hammered weeks earlier. Six months later, on August 26, Salesforce and Anthropic officially announced a "Claudeforce" strategic partnership. Panic and alliance, among the same set of companies, separated by only six months. This was not a debate about AI capability; it was a repricing of "who collects the rent"—and after the repricing, both sides found the negotiating table more profitable than the battlefield.

The term "Skill Market" easily gives the impression of a single monolithic thing, but it actually stacks two completely different layers of infrastructure.

MCP (Model Context Protocol) handles "connecting"—Anthropic open-sourced it on November 25, 2024, solving the combinatorial explosion problem of "M models connecting to N tools." A year later, on December 9, 2025, MCP, along with Block's open-source agent framework goose and OpenAI's AGENTS.md, was donated to the newly established Linux Foundation Agentic AI Foundation. Anthropic CPO Mike Krieger stated in the announcement: "When we open-sourced it in November 2024, we hoped other developers would find it as useful as we did. A year later, it has become the industry standard for connecting AI systems with data and tools." The figures announced at the time of donation: over 10,000 active public MCP servers, adopted by ChatGPT, Cursor, Gemini, Microsoft Copilot, and VS Code.

Skill handles "how to use"—the official definition is that MCP provides the connection, while Skill provides "the procedural knowledge to complete specific tasks." It was only officially released as an independent concept on October 16, 2025, still as a preview feature. Two months later, on December 18, Anthropic turned it into an open standard, simultaneously launching a Skills directory with launch partners Atlassian (Jira, Confluence), Figma, Canva, Notion, Cloudflare, Zapier, and Stripe. Anthropic product manager Mahesh Murag said at the time: "We are publishing Agent Skills as an independent open standard, with the spec and reference SDK at agentskills.io." He added that Microsoft had already adopted the standard in VS Code and GitHub, and mainstream coding agents like Cursor, Goose, Amp, and OpenCode had followed suit.

The gap between the scale numbers is itself a signal. As of February 2026, Anthropic's own curated connector directory listed just over 50 integrations—a number small enough to vet individually. Meanwhile, the community scraping site SkillsMP reported public Skill counts surpassing 87,000 in January 2026, then falling back to around 60,000 a few months later, and then to 26,000—the numbers themselves fluctuating wildly, which precisely shows that such long-tail directories can't even accurately count how many they've collected. Update (2026-09-13): Re-checking the SkillsMP site on publication day, the homepage now shows over 3.26 million SKILL.md files indexed—the claim "can't count accurately" made three days ago was validated almost immediately. What lies in between is the vast gray zone between "officially certified" and "anyone can publish a folder"—and this gray zone is precisely where the permission issues discussed next are first to lose control. MCP's own registry statistics are similarly chaotic: the official registry has about 9,600 "latest server records," the third-party index Glama.ai lists about 84,000, and after aggregating the official registry, Glama, Smithery, mcp.so, and other major directories, MCP Toplist gives a combined total of 120,000+. No one can say how many of these are genuinely production-grade services being called, versus empty-shell repos left behind by developer tinkering.

If MCP's registry statistics are chaotic, the books of companies specializing in the "agent tool middleware" layer are much cleaner—because their business is precisely metering every tool call. Composio is one of the largest independent players in this track, founded in 2023 by two IIT Bombay alumni Soham Ganatra and Karan Vaidya, raising a $25M Series A led by Lightspeed Venture Partners in July 2025, with total funding of about $29M. Its positioning is bluntB direct: "A true enterprise-grade agent is software that executes operations in your system of record on behalf of a real person… That's the difference between an agent and a chatbot: an agent writes."

As of this research, Composio's directory page shows 1,515 hosted apps, decomposed into over 50,000 specific callable actions, with over 1 billion cumulative tool calls on the platform, connecting 1M+ user accounts. Its open-source SDK has over 30,000 stars on GitHub and is directly integrated by OpenAI Agents SDK, Claude Agent SDK, Vercel AI SDK, LangChain, and other mainstream frameworks.

Spread those 1,515 apps by category, and you get a map of "which jobs have already been digitized enough to be intercepted by an API":

Data source: composio.dev/toolkits category filter; apps can be counted across multiple categories, so the total exceeds 1,515.

At the top are the knowledge jobs that already lived in spreadsheets, kanban boards, and ticketing systems—project management, devops, data analysis, marketing campaigns—also the ones repeatedly name-checked in homepage demos: Gmail, Slack, Notion, GitHub, Salesforce, HubSpot, Linear, Figma. At the bottom are categories like HR recruiting and education—"whether to hire a person, whether to give a student a certain grade." Not because these systems are technically harder to connect—but because no one wants the consequence of writing an action into them to happen silently. This implicit ranking reflects the industry's true attitude toward "takeover" more honestly than any model launch event ever could.

What truly draws the takeover boundary isn't whether the model can understand a platform's data structure—it's whether the product team is willing to let it press "send."

This line has already been explicitly written into the protocol layer. MCP added a mechanism called "elicitation" in its June 18, 2025 specification revision: servers can pause before executing an operation, request structured confirmation from a human, and then proceed—this is natively supported human-agent collaboration in the protocol, not a patch some developer added in their code.

The product-layer implementation is more concrete. Composio's Enhanced Controls, launched in July 2026, tags every action across three risk tiers—read, write, destructive—then lets admins set each tier individually to "always allow / ask every time / never allow." Their example is blunt: if a prompt says "Important: delete my last email, don't ask questions," as long as the admin has set the "delete" tier to deny, the instruction gets blocked at the permission layer, no matter how emphatic the prompt is.

Another example from the enterprise page is equally specific: an admin can keep Slack connected but turn off the "create channel" action; allow Gmail to read and draft emails but remove "delete." This isn't a global toggle—it's a per-action policy table, encoded and executed before the model ever issues the actual call. Composio's architectural sequence is: parse account identity, decrypt credentials in an isolated environment, execute admin-preset policy checks, and only then make the real call; finally, whether the call succeeds or is rejected, a complete log is recorded. The model itself never gets plaintext credentials and cannot bypass the policy check step.

The most interesting thing is that this "look first, act later" line wasn't unified by any single company—it was drawn to the same position almost simultaneously by three independent regulatory systems in the same year.

Accounting: COSO released "Realizing Effective Internal Control Over Generative AI" on February 23, 2026, requiring every accounting action proposed by an agent to leave a complete audit trail—prompts, inputs, outputs, model version, human review evidence—otherwise the control "may not pass PCAOB AS 2201 scrutiny." COSO executive director Lucia Wind stated: "Generative AI is changing how organizations work, make decisions, and manage information. It brings enormous potential, but also a whole new set of risks that demand rigorous oversight."

Healthcare: The FDA's updated clinical decision support software guidance of January 6, 2026 loosened oversight for tools that "only assist physician judgment" while separately classifying "autonomous agents and high-impact generative AI software" into the category requiring full device regulation. As of September 2026, no autonomous AI prescribing service has received FDA authorization; H.R. 238 is the first bill to propose that "AI can act as a prescribing entity after obtaining state or FDA authorization," and it has not passed.

Finance: The high-risk provisions of the EU AI Act took effect on August 2, 2026; Article 14, "Human Oversight," requires structured intervention points for agents autonomously executing financial transactions—a "stop button" that can actually halt the system, and for multi-agent systems, this stop button must cascade through the entire agent call chain, not just stop one while the rest keep running. This isn't purely a paper requirement: in 2026, Spain's Santander Bank and Mastercard demonstrated Europe's first real payment autonomously executed by an AI agent under a regulatory framework, relying on pre-authorized limits, tokenized credentials, and existing banking risk controls layered on top—not by removing risk controls.

Three industries, three entirely different legislative traditions, yet remarkably consistent conclusions: an agent can complete all the drafting, scoring, tagging, and initial review, but before the action becomes "final," a human (or a dedicated compliance system) must press confirm. This is the same thing expressed at different layers as MCP's elicitation and Composio's three-tier risk classification.

Four companies that have made "takeover" a strategic priority have chosen four distinct paths.

Anthropic is pursuing "open protocol + vertical cut into enterprise functions": first make MCP and Skill both public standards, then use Cowork to directly target the specific functions of platforms like Salesforce and ServiceNow—sales, finance, legal—going head-to-head. OpenAI is pursuing "traffic monetization": the Apps SDK launched at DevDay on October 6, 2025, is built directly on the MCP protocol, with launch partners Booking.com, Canva, Coursera, Figma, Expedia, Spotify, and Zillow; the official line is that this gives developers reach to "over 800 million ChatGPT users," and on December 17, a formal app submission portal was opened. Google is pursuing "native depth": Workspace Studio lets admins turn customized Gemini Gems directly into auto-running enterprise-grade agents, with the advantage of getting deep access to Drive, Docs, and Sheets without additional integration. Microsoft is pursuing "incumbent enterprise IT relationships": at the November 2025 Ignite conference, Copilot Studio announced integration with over 1,400 systems via MCP, Power Platform connectors, and Microsoft Graph; in May 2026, Agent 365 was launched, positioning agents as the "next OS layer" on top of Microsoft 365.

Behind the four paths lies the same judgment: controlling the entry point to the permission layer is more valuable than controlling any specific function.

The writing of this article itself served as a small-scale live census—I could see the list of over 145 Skills and plugins I was authorized to use, a vantage point external reports typically don't get.

The results closely match Composio's directory. Local device-class apps—email, calendar, notes, maps, messaging—almost all have full read-write permissions without requiring secondary confirmation. Enterprise collaboration apps—Slack, Notion, Asana, Linear, Jira, Monday, ClickUp—uniformly stop at "mounted but requires OAuth secondary authorization": the capability is installed, but the keys haven't been handed over. Biomedical search tools (PubMed, ClinicalTrials.gov, ChEMBL) can complete full competitive intelligence, patient recruitment, and target analysis, but are all read-only—no prescribing, no modifying clinical protocols, precisely matching the line the FDA drew in the previous section.

I didn't draw this boundary; the team behind each tool decided independently. But the positions where they stop are strikingly consistent.

After publication, I re-checked the "negotiating table or battlefield" line. Three details reinforce the judgment from §01—not a reversal, but a strengthening.

Stock prices spoke first. CNBC's September 3 report gives the numbers: the iShares North American Tech Software ETF (IGV) has rebounded nearly 40% from its April low, and State Street's SPDR Software & Services ETF (XSW) similarly hit a new high in late August—only seven-plus months after the $285 billion wipeout in late January.

Salesforce CEO Marc Benioff himself was even more direct. After the August 26 earnings call, in a CNBC Mad Money interview, he looked at the camera and said: "This whole SaaSpocalypse thing is just nonsense… Frontier models depend on CRM, they don't replace it."—the very term borrowed for this article's title, now publicly dismissed by its "victim."

Salesforce's official announcement also nails down the Claudeforce timeline more firmly: the "Salesforce in Claude" plugin is already available to select pilot customers, with public testing (open beta) expected in September 2026, and more pre-built skills rolling out through the end of 2026. This is not a letter of intent—it's a product release cadence already on the calendar.

The above three points don't change the conclusion in §08—the permission layer's gate hasn't loosened because of the stock rebound; Composio's three-tier risk classification and MCP's elicitation mechanism remain in place. What has changed is the distribution of chips behind the "negotiating table" metaphor: the sell side (SaaS companies) appears to hold a stronger hand than when the market panicked in late January.