Claude Code Mods Security: Researchers Flag Four Trust Gaps

What happened

Anthropic has opened Claude Code to modification from the inside. According to an announcement from the official @ClaudeDevs account, version 2.1.287 of the command-line tool introduced "mods." These are small TypeScript programs that can change how the agent behaves, customize its interface, or swap in new features. 3 Mods ship inside plugins and install through the /plugin command in the CLI or desktop app. Developers can write them by hand or ask Claude to generate one. 3 Anthropic has also built several mods of its own. The documentation lists a skill for writing new mods and a side agent that monitors long sessions, though neither has a linked public repository. 3

Shortly after launch, Pluto Research published an analysis of the function-hook model behind mods. It identified four trust gaps:

• Mods can quietly read secrets.
• Users get no disclosure of a mod's capabilities before installing it.
• Mods can spoof parts of the interface.
• A mod's code can change after it has been reviewed, which opens a path to remote code execution. 1

How mods work, and where accounts differ

Pluto describes mods as in-process plugins that attach to Claude Code's events as TypeScript functions. Every privileged action passes through a single engine interface called $, covering file reads, command execution, network access and UI rendering. 1

The sources disagree on whether mods are sandboxed, and the difference matters.

A DEV Community analysis says flatly that there is "no sandbox," along with no review process and no code signing. 2 It compares mods to browser extensions with full page access rather than to App Store apps running in containers. 2

Pluto's hands-on testing paints a more detailed picture. Mod code runs in a worker with no ambient fetch, require, or import. A static scanner records which $ methods a mod references, giving Claude Code a list of the capabilities it requests. 1 Pluto also found several protections that hold. A mod's origin and tier are attributed by the host and cannot be spoofed, and mods cannot rewrite how the tool-approval prompt is displayed. 1

Both descriptions can be true at once. Direct access is restricted, but the $ interface still exposes files, shell commands and the network. A worker boundary is not much of a sandbox if the approved interface can do most of what the boundary blocks. The problem Pluto describes is less a missing wall than a missing warning: Claude Code knows what a mod is asking for but does not tell the user before installation. 1

Why it matters

The DEV piece frames mods as the moment Claude Code became a platform. It argues the comparison to Apple's App Store fails on the details. Apple launched with review, sandboxing and a payment system. Claude Code mods launched without any of those. 2 Anthropic does offer some tools. claude plugin validate checks manifest structure, though not behavior, and a --safe-mode flag disables hooks entirely. 2

The risk is concrete. The DEV article cites a study of 31,132 agent skills that found 26.1% contained at least one security vulnerability. Data exfiltration appeared in 13.3% of skills and privilege escalation in 11.8%. Skills bundling executable scripts were 2.12 times more likely to carry flaws. 2 Mods sit deeper in the stack than skills because they run inside the agent's event loop. That makes those base rates a reasonable warning sign.

Of Pluto's four findings, two stand out for developers:

• UI spoofing. Claude Code is a tool users trust to show them what the agent is doing. The approval prompt itself appears protected. Even so, a mod able to draw convincing interface elements elsewhere can mislead users at the moments they make security decisions. 1
• Code changing after review. If a mod's behavior can shift after someone has inspected it, a one-time audit means little. Pluto ties this to remote code execution risk. 1

The takeaway

The engineering under mods appears more careful than the most alarmed reading suggests. Anthropic built a capability chokepoint, a static scanner and host-attributed provenance. 1 The weak point is between that machinery and the person clicking install. Capability data exists but is not shown to users, approved code may not stay fixed, and there is no ecosystem-level review or signing. 12

The likely fixes follow from Pluto's findings. Anthropic could show users the capability manifest before installation, pin reviewed code so it cannot change silently, and eventually add signing. Until then, developers should treat mods the way security teams treat browser extensions:

• Install only from authors you would trust with your shell and secrets.
• Read the source before installing.
• Use --safe-mode when working near credentials. 2