Claude Code Mods Security: Function Hooks Expose Plugin Gaps

What happened

Within days of Anthropic launching Mods for Claude Code, a security team had already found serious problems in how the extension layer works. Pluto Security's research arm tested the new system and identified four distinct risks tied to function hooks, ranging from silent access to secrets to user-interface spoofing and remote code execution. 1

The specifics are uncomfortable for anyone who treats a coding assistant as a trusted part of their workstation. According to the testing, a mod can read Claude's credential files and session history and quietly send them off the machine without any visible sign. 2 That alone would be a notable supply-chain concern. But the more consequential finding involves the review process meant to catch such behavior.

The disclosure problem

Anthropic's recommended practice before installing a mod is to inspect it, and the claude plugin details command exists for exactly that purpose. Pluto found that this command could report "Hooks (0)" for a mod that in fact hooks every event. 2 A validation step that undercounts a mod's reach is arguably worse than no validation step at all, because it gives a careful user false assurance at the precise moment they are trying to be careful.

Taken together, the two writeups describe the same core issue from slightly different angles. Pluto's own framing emphasizes the breadth of what function hooks can do, cataloguing four categories of risk that escalate up to remote code execution. 1 The aitmpl.com coverage puts more weight on disclosure and enforcement: what users can see, and whether the guardrails actually hold. 2 They are complementary rather than contradictory. One maps the attack surface, the other asks whether the tools meant to police that surface are reliable.

Enterprise guardrails weren't airtight either

The concerns extend beyond individual developers installing mods on personal machines. Anthropic ships a guardrail called sec-default for Team and Enterprise customers, intended to give administrators control over what mods can do on managed devices. 2 That protection had its own gap at launch. Version 2.1.289, released October 3, patched a bug in which a mod's approval could override a deny rule for part of a compound shell command on managed machines. 2

The detail matters because compound commands, several shell operations chained together, are routine in development workflows. If an administrator's deny rule can be bypassed for one segment of such a command, the policy is only partially enforced. The flaw has been fixed, but its existence at launch suggests the policy layer was not tested against the full range of ways commands get assembled in practice.

Why it matters

Coding agents occupy a privileged position. They run in developers' terminals, touch source code, and often sit alongside cloud credentials, API keys, and SSH configuration. An extension system that can hook into every event, without a sandbox, effectively inherits much of that privilege. The aitmpl.com analysis describes Mods as an "unsandboxed extension layer" and characterizes these findings as the first concrete evidence that it has disclosure and enforcement gaps that are shipping faster than fixes can follow. 2

This is a familiar pattern in developer tooling. Package registries, browser extensions, and IDE plugin marketplaces have all gone through phases where convenience outran review, and attackers exploited the gap before controls matured. What distinguishes the Claude Code case is the speed: the problems surfaced within days of launch, and they include a flaw in the very inspection command users are told to rely on.

What to make of it

The reasonable reading is not that Mods are uniquely dangerous, but that the trust model around them is currently weaker than Anthropic's guidance implies. Extensibility with hooks into every event is powerful by design; the risk Pluto documented follows directly from that power. 1 The more fixable failures are the ones around visibility and policy: a details command that can misreport hooks, and an enterprise deny rule that could be beaten. 2

For teams evaluating Claude Code, the practical takeaway is to treat third-party mods the way they would treat any unvetted dependency with access to secrets. That means reviewing source directly rather than relying solely on the built-in summary, keeping the client updated to pick up patches like the October 3 fix, and assuming that credential files on a developer machine are reachable by anything installed there.

For Anthropic, the test will be whether disclosure becomes trustworthy, so that what the tooling reports matches what a mod actually does, and whether sandboxing or finer-grained permissions follow. Until then, the extension layer looks like a new supply-chain surface that defenders will need to watch closely.