State of AI instructions, 2026 · Standards | TomeVault

Findings<br>0178.7% of repositories that use AI coding tools configure only one of them.<br>Their developers do not stop at one. Most run two to four AI tools, so every other assistant is left working that codebase with nothing to go on.

02AGENTS.md was built to bridge tools. Only 18.3% of the repositories that use it or CLAUDE.md use both.<br>The one cross-vendor standard is being adopted as a replacement, not a bridge. It moves the split, it does not close it.

03Nine in ten repositories that ship both CLAUDE.md and AGENTS.md never connect them, so the second file is never read.<br>The team maintains two contracts and gets the coverage of one, then blames the model for ignoring rules it was never handed.

0426.3% of CLAUDE.md files run past the 200-line guideline Anthropic publishes in its own docs.<br>Past that length a file does not just waste context. A 2026 study found it lowers the rate at which the agent finishes the job.

0555.8% of instruction-file repositories grant no usable right to redistribute the file.<br>The year gave these files install commands, directories, and marketplaces. The majority of what they distribute, nobody granted permission to distribute.

06Signing adoption in the open corpus is zero : of 986 probed repositories, none sign their instruction files.<br>The trust layer the industry built this year exists where a distributor requires it, and so far nowhere else. Trust is becoming a property of the channel, not the file.

075.0% of 219,024 scanned instruction files carry at least one deterministic safety finding.<br>ClawHavoc was the loud version. This is the quiet base rate, in files agents load by default with no scan at all.

The bottom line. The world around the instruction file grew up this year: governed standards, an install command, a trust stack, a threat model. The files themselves have not caught up. They serve one tool in a multi-tool world, they are unlicensed for the distribution they are getting, and the trust layer built for them is, in the open corpus, used by nobody.<br>78.7%<br>configure only one AI coding tool

55.8%<br>grant no right to redistribute the file

repositories in a 986-repo probe sign their instruction files

The instruction file stopped being a private convention between a developer and one tool. Over nine months it picked up neutral governance, a package-manager-style distribution layer, vendor catalogues, security taxonomies, and an incident record. The dates below are the spine of that story; the rest of Part I walks the three that matter most.<br>9 Dec 2025The Linux Foundation forms the Agentic AI Foundation, with Anthropic’s Model Context Protocol, Block’s goose, and OpenAI’s AGENTS.md as founding projects. The instruction-file standard now has a neutral home.

Dec 2025Anthropic releases Agent Skills as an open standard (agentskills.io): a folder with a SKILL.md that packages instructions for any agent that loads it.

15 Jan 2026The first large-scale audit of the new format posts to arXiv. Of 31,132 skills analysed, 26.1% contain at least one vulnerability pattern.

20 Jan 2026Vercel ships the skills CLI and skills.sh, a directory and leaderboard for skill packages. Instructions get an install command.

1 Feb 2026Koi Security discloses ClawHavoc: 341 malicious skills on ClawHub, the marketplace serving the OpenClaw agent. The format’s first documented poisoning campaign.

17 Feb 2026skills.sh adds automated security audits from three vendors (Gen Digital, Socket, Snyk); skills flagged malicious are hidden from search and leaderboards.

Feb 2026ETH Zurich publishes the first controlled study of context files: over-specified files reduce agent success and add more than 20% cost. Lean beats long.

13–26 Mar 2026A community RFC asks the Agent Skills spec to absorb cryptographic signing. The spec maintainer declines, pointing to the distribution layer instead.

16 Apr 2026GitHub ships gh skill in public preview: install, search, publish, with version pinning and content-addressed change detection, deliberately not centralised verification.

22 Apr 2026Google launches its official skills repository on the open Agent Skills format, announced on Day 1 of Cloud Next.

19 May 2026NVIDIA announces Verified Agent Skills: scan, skill card, detached signature, verify at install, on the open spec. The same day, Google’s enterprise Skill Registry enters public preview.

3 Jun 2026Andrew Nesbitt, who built Libraries.io and runs Ecosyste.ms, publishes the gap plainly: the trust machinery package registries spent a decade building mostly does not exist for skills.

The two formats that matter most ended the year under neutral governance or open specification, with the largest vendors publishing into them.<br>AGENTS.md spent its first year as an OpenAI repository convention. On 9 December 2025 it became a founding project of the Agentic AI Foundation, a directed fund under the Linux Foundation, alongside the Model Context Protocol and goose....