AI Agent Marketplace: What to Check Before You Install One

An AI agent marketplace is a listing page: instead of configuring an agent yourself, you pick one someone else already built for a specific job — drafting replies to support tickets, chasing unpaid invoices, scheduling meetings — and install it. The pitch is real; skipping the setup work is genuinely useful. The part a listing rarely makes obvious is what you are actually installing: how much it can touch, which model is doing the reasoning behind it, and what happens the moment it gets something wrong.

What a listing tells you, and what it leaves out

• —What it is allowed to do. The real question is not what the agent does when it works, but what it can reach when it fails — your calendar, your inbox, your customers’ data. AI agent takes control of your computer: what to check covers the permission question directly for the computer-use kind of agent, and the same checklist applies to a marketplace listing before you click install.
• —What is actually running underneath. "Agent" on a listing page can mean a thin wrapper around one model call, or a genuine multi-step system that plans, calls tools and checks its own work. AI agent vs LLM: what’s actually different covers that distinction, and it matters here because the two fail in different ways and recover from failure differently.
• —Which design pattern it follows, if any. A listing that can explain whether it runs a single pass or a reflect-and-retry loop is telling you something real about how it behaves under an edge case. Agentic design patterns: the four worth knowing names the patterns worth asking a vendor about by name.

A worked example: choosing between two scheduling agents

Weak approach: install the one with the higher star rating and a short free trial, connect it to your calendar and email, and see what happens.

Better approach: before connecting anything, read the permissions screen the same way you would a contract. Does it need read-only calendar access, or can it send invites on your behalf without asking first? Does it need your full inbox, or just a specific shared calendar? Ask the vendor, in writing, what it does when a meeting request is ambiguous — does it guess, or does it hold and ask you? A vendor that cannot answer that last question plainly has not actually tested that path.

Agentic AI architecture: what the pieces actually do is worth reading before this conversation if the vendor’s answer is full of architecture terms you cannot evaluate — it covers what each piece (planner, tool caller, memory) is actually responsible for, so a vague answer becomes easier to spot.

Where this goes wrong

The caution here is not hypothetical or specific to small vendors. In October 2026, Microsoft CEO Satya Nadella said publicly that AI agents should be treated like insider threats inside an organisation — not because they are malicious, but because frontier models still cannot be fully trusted with the access an agent needs to do its job, and that is from the company shipping some of the most capable agent tooling available. The same caution shows up from a model developer’s side: DeepMind’s own post on securing AI agents treats agent permissioning as an active, unsolved problem, not a solved checkbox you can trust a vendor to have ticked for you.

What that means for a marketplace listing specifically: the agent you install did not go through your organisation’s own review, only the marketplace’s, and marketplaces vary enormously in how much they actually check before listing something. The permission screen in front of you is the control you still have.

Installing an agent you did not build means trusting someone else’s judgement about what it needs access to. Read the permissions screen like you mean it.

Checks before you grant access

1. 01Grant the narrowest permission that lets the agent do its one job — read-only before read-write, one calendar before the whole account — and widen it later only if the narrow version genuinely cannot do the job.
2. 02Ask what happens on an ambiguous or low-confidence case: does it hold and ask you, or proceed on its best guess? Anthropic’s own guidance on tool use covers why this handoff point is where a well-built agent is designed to stop and check, rather than press on regardless.
3. 03Run it for a week on a low-stakes task before connecting it to anything that touches a customer or a payment.
4. 04Check what data it stores and for how long, not just what it can access live — a vendor’s own privacy and safety documentation, where published, is the place to verify this rather than the marketing page. OpenAI’s own privacy and safety FAQ for its dots agent is a worked example of what that kind of documentation should actually answer.
5. 05Decide in advance what you would check to notice it quietly failed — a task count that stops rising, a queue that stops clearing — the same monitoring habit the NIST AI Risk Management Framework recommends for any automated system, scaled down to one installed agent.

What to do Monday

Before installing anything from a marketplace this week, open its permissions screen first and work out the narrowest access that still lets it do the one job you want. AI agents examples: what four real ones actually do is worth reading if you are still deciding which category of task is actually worth handing to an agent in the first place, and agentic framework: do you actually need one? covers the build-versus-install decision directly if a marketplace listing turns out not to fit your actual case closely enough.

Knowing which access to grant and which to withhold is exactly the kind of judgement that is becoming a measurable part of a job description — PwC has tracked a 62% wage premium for workers with demonstrable AI skills, up from 57% the year before. Coursium teaches that judgement directly, one short lesson at a time. Stay ahead of AI by learning the tools on your phone.