Claude Code Mods: Unsandboxed Plugins Raise Review Risks

What shipped

Anthropic has opened Claude Code to in-process extensions. With version 2.1.287, released on 1 October 2026, the command-line coding agent supports "mods": small JavaScript or TypeScript files packaged inside plugins that stay loaded for the whole session 12. A mod can observe, alter, or take over what Claude Code is doing, and it can draw on the screen 1. The official @ClaudeDevs account announced the release with a short pitch: change how the agent behaves, customize the UI, and swap in your own features, using a few lines of TypeScript or by asking Claude to write the mod 3. Mods install through the existing /plugin command in the CLI or the desktop app 3.

The feature was public before launch. A capability called "Function Hooks" appeared on X on 3 September, became available behind an opt-in flag, was renamed "Claude Mods" on 9 September, and was described as "landing now" by Boris Cherny on 14 September 1. The launch post had about 4.3 million views within three days 1.

The security model is the story

The main concern is what mods are allowed to do. Mods are turned on by default from 2.1.287, and the old CLAUDE_CODE_ENABLE_FUNCTION_HOOKS setting no longer has any effect 12. They run inside Claude Code's own process, without a sandbox, and with the user's permissions 2. Handlers can intercept and rewrite tool calls, submitted prompts, and parts of the interface as it renders 2. One security analysis says they can read secrets, approve tool calls before the user is asked, and spawn processes outside the sandbox 2.

There are some limits. A mod can restyle most of the interface but not the permission prompt itself, so it cannot change what that prompt displays 2. In an interactive session in a directory the user has not yet trusted, no mod loads until trust is granted 2. For organizations, the key control is allowManagedModsOnly, which restricts loading to approved mods. Without it, mods can come from any plugin marketplace 2. A community catalog already lists 45 mods 2.

Those protections address a narrow part of the problem. A mod cannot alter the text of a permission dialog. But if it can approve tool calls before the dialog appears, the dialog may never be shown for actions the mod has already approved. That is a reading of the documented behavior, not a confirmed exploit. Still, it explains why researchers are focused on whether users can see what their mods are actually doing.

Early fixes hint at the edge cases

The patch history after launch supports that concern. Version 2.1.288 arrived a day later with the first mod fixes and a new $.ui.selection() API 1. Version 2.1.289, on 3 October, fixed stale copies in local marketplaces. It also fixed a case on managed machines where a mod's approval overrode a deny rule for part of a compound command 1. That second bug is significant. Deny rules are what administrators use to block risky shell activity, and a mod-granted approval was able to get past one. Anthropic fixed it quickly, but it shows how much authority mods hold within the permission system.

Anthropic's own mods

Anthropic is also shipping first-party mods. According to the documentation, these include a skill for writing new mods and a side agent that watches long sessions, though neither has a linked public repository 3. Closed-source official extensions are common. But when the extension model runs unsandboxed code inside the agent, users and security teams have reason to expect that the reference implementations can be inspected.

Our read

Mods are a substantial change. They turn Claude Code from a configurable tool into a platform where third-party code can sit between the user and the agent. The ecosystem is moving fast, with dozens of community mods within days, and that suggests real demand 2. The choice to enable mods by default and run them unsandboxed favors ease of use over isolation. The safeguards that do exist, such as trust prompts, a protected permission dialog, and managed-only mode, depend on users and administrators actively using them.

Teams running Claude Code should take three steps. Enterprises should enable allowManagedModsOnly. Plugins should get the same scrutiny as any dependency that can read secrets. Everyone should upgrade to at least 2.1.289 so the deny-rule bypass is closed 12. Individual developers should check what each mod does before installing it, because a single /plugin install can now affect every action the agent takes.