Skip to content
Today
Sections

Build Widely confirmed5 publishers 3 min read Published Updated

Claude Code mods let unsandboxed plugin code answer the agent's permission requests

Anthropic's Claude Code mods, on by default from 2.1.287, let JavaScript or TypeScript code rewrite prompts, block tool calls and approve permission requests. For teams, the governance question moves from what the agent is told to which code it runs.

The Engineer · Build desk

Send a correction

Illustration accompanying Claude Code mods let unsandboxed plugin code answer the agent's permission requests
Generated illustration

What happened

  • Anthropic says mods are not sandboxed and get the same access to the user's machine as Claude Code itself, and it advises installing only mods from trusted sources.
  • On Team and Enterprise plans and on managed machines, a built-in mod called sec-default loads first and blocks risky behaviour such as overriding permission-deny rules.
  • Administrators may load their own mods ahead of sec-default, but Anthropic says they should bundle it to keep its restrictions in force.
  • Team and Enterprise administrators can allow or block the plugin marketplaces through which mods are distributed.

Why it matters

  • Who's exposed exposure Every installed mod is its publisher's code running with the agent's privileges, so reviewing a plugin now means reviewing code that can approve the agent's permission requests.
  • What it limits constraint Since mods run in the order they load, an organisation-wide mod placed first sits ahead of every guard, and mod ordering now needs the same change review as the permission rules.
  • What it sets up precedent With /diff already swappable, Claude Code's built-in features sit in the same replaceable layer as third-party code, so a team's agent can drift from the stock build one feature at a time.

A CLAUDE.md file holds persistent instructions. Settings, hooks and MCP servers could already shape those instructions, Claude's permissions and its tools [12]. None of them could change Claude Code's own features or the rest of its interface [12]. A mod is code on the event path: it runs before, after or in place of an event [5]. It stays loaded for the whole session, so it can carry state from one event to the next [16]. Anthropic says its earlier hooks could not rewrite events or draw new interface elements [7].

The API first appeared on GitHub on September 3 as a proposal for "function hooks". Six days later Anthropic said it would ship under the name Claude Mods and keep function hooks as the mechanism underneath, so the main change that week was the label [13].

Anthropic pitched the launch at individuals [20]. "Each person works differently, so there's no reason why everyone should have an identical Claude experience," Boris Cherny, who created Claude Code, wrote on X [20]. Addy Osmani, a member of Anthropic's technical staff, wrote in the launch post: "That makes mods a way to fit Claude Code to how you work." [21]

The team guard shows what the API allows. Anthropic wrote sec-default to stop mods overriding permission-deny rules [8]. That job exists only because a mod can approve or deny permission requests in the first place [5]. I think shipping the guard as a mod, inside the same system as the code it polices, is a reasonable first design.

Anthropic also says developers can ask Claude Code to write a mod, install it and reload it during a session [14]. Put that next to the permission hooks and the agent can draft the code that later answers its own permission requests [5][14]. The sources describe sec-default only for Team and Enterprise plans and for machines with managed settings [8].

Mods can also redact secrets from tool output [5]. A team would put its own controls in those same hooks. Anthropic's Blast Radius sample pauses rm -rf, hard Git resets and force pushes, then shows what they would affect before the user goes ahead [17]. Within hours of the launch, one developer had built a mod that passes credentials to Claude without leaving the secret in the conversation history [18]. Token Weather, about 80 lines long, reports context use as a forecast. It reaches "Storm" at 81% of a 200,000-token window, or 162,000 tokens [19][22].

The choice I would defend is that Anthropic builds its own features on the API. AGENTS.md support already runs as a mod, and the source for Anthropic's mod-built features is published in the Claude Code repository [4].

What to watch

  • Whether Anthropic extends sec-default, or an equivalent guard, to individual plans and to machines without managed settings.
  • Any move to sandbox mods or give them narrower access than Claude Code itself has.
  • Which built-in features Anthropic moves into the mod layer after /diff and AGENTS.md support.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence78
Adoption15
Hype gap+15
Incentives60
Confidence72

Perspective Coverage

5 publishers
Builder
Builder 59%
Operator
Operator 36%
Investor
Investor 5%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Mods are small JavaScript or TypeScript functions that hook into events inside Claude Code; a mod can rewrite a prompt before it reaches the model, block or rewrite a tool call, handle permission requests, replace parts of Claude Code's interface, or add new functionality.

    Reported Supported Source: The New Stack, describing Anthropic's launchView cited source
  2. [2]

    Anthropic says mods are not sandboxed and have the same access to a user's machine as Claude Code, and advises users to install only mods from sources they trust.

    Reported Supported Source: Anthropic, via RuntimeWireView cited source
  3. [3]

    Anthropic has moved its built-in /diff feature into the mod system, where users can disable it or substitute their own version.

    Reported Supported Source: RuntimeWireView cited source
  4. [4]

    Anthropic says it already uses mods for features including AGENTS.md support and the /diff pane, and has published their source in the Claude Code repository.

    Reported Supported Source: Anthropic, via The New StackView cited source
  5. [5]

    A mod can run before, after or in place of an event in Claude Code; Anthropic says mods can rewrite prompts, block or retry tool calls, approve or deny permission requests, and redact secrets from tool output.

    Reported Supported Source: Anthropic, via RuntimeWireView cited source
  6. [6]

    Mods are enabled by default in Claude Code 2.1.287 and later.

    Reported Supported Source: The New StackView cited source
  7. [7]

    Anthropic says hooks offered some customization already but could not rewrite events, draw new interface elements or replace features.

    Reported Supported Source: Anthropic, via RuntimeWireView cited source
  8. [8]

    On Team and Enterprise plans, and on machines using managed settings, a built-in mod called sec-default loads first and blocks risky behaviour such as overriding permission-deny rules.

    Reported Supported Source: Anthropic, via RuntimeWireView cited source
  9. [9]

    Administrators can load their own mods first, but Anthropic says they should also include sec-default to retain its restrictions.

    Reported Supported Source: Anthropic, via RuntimeWireView cited source
  10. [10]

    Team and Enterprise administrators can allow or block plugin marketplaces.

    Reported Supported Source: Anthropic, via RuntimeWireView cited source
  11. [11]

    Because a mod can affect permission requests and tool calls, installing one amounts to running code from its publisher with the agent's privileges.

    Reported Supported Source: RuntimeWire analysisView cited source
  12. [12]

    Developers could already customize Claude Code via settings, persistent instructions in CLAUDE.md, hooks and MCP servers; those controls shape the instructions Claude follows, its permissions and its tools, but cannot change Claude Code's own features or the rest of its interface.

    Reported Supported Source: The New StackView cited source
  13. [13]

    Anthropic first floated the idea on GitHub on September 3 as 'function hooks'; six days later it said it planned to ship the feature as 'Claude Mods' while retaining function hooks as the underlying mechanism.

    Reported Supported Source: The New StackView cited source
  14. [14]

    Anthropic says developers can ask Claude Code to write a mod, install it and reload it during a session.

    Reported Supported Source: Anthropic, via RuntimeWireView cited source
  15. [15]

    Mods can be stacked, and Anthropic says they run in the order they load.

    Reported Supported Source: Anthropic, via RuntimeWireView cited source
  16. [16]

    Because a mod's code stays active throughout a session, it can remember information between events and interact with Claude Code as things happen.

    Reported Supported Source: The New StackView cited source
  17. [17]

    The Blast Radius sample mod pauses potentially destructive shell commands, including rm -rf, hard Git resets and force pushes, and shows what they would affect before the user proceeds.

    Reported Supported Source: RuntimeWireView cited source
  18. [18]

    Within hours of the announcement, one software developer built a mod for passing credentials to Claude without leaving the underlying secret in the conversation history.

    Reported Supported Source: The New StackView cited source
  19. [19]

    Token Weather, an approximately 80-line mod, tracks context-window consumption and displays 'Clear' at 18%, 'Showers' at 67% and 'Storm' at 81% of a 200,000-token window.

    Reported Supported Source: Addy Osmani's blog post, via The New StackView cited source
  20. [20]

    "Each person works differently, so there's no reason why everyone should have an identical Claude experience."

    Reported Supported Source: Boris Cherny, Claude Code creator, writing on XView cited source
  21. [21]

    "That makes mods a way to fit Claude Code to how you work."

    Reported Supported Source: Addy Osmani, member of technical staff at Anthropic, in a technical blog postView cited source
  22. [22]

    Token Weather's 'Storm' threshold of 81% of a 200,000-token window is 162,000 tokens.

    Derived Supported

Sources

5 independent publishers whose own reporting we read for this story.

  1. claude.com

    1 article · September 30, 2026

    Customize Claude Code with mods in TypeScript | Claude by Anthropic
  2. dev.to

    3 articles · October 3, 2026

    Claude Code v2.1.287: Skills Instruct. Mods Decide.
  3. runtimewire.com

    1 article · October 1, 2026

    Anthropic lets Claude Code mods rewrite prompts and approve tool permissions
  4. the-decoder.com

    1 article · October 3, 2026

    Claude Code's new Mods system lets developers rewrite the AI coding tool from the inside
  5. thenewstack.io

    1 article · October 2, 2026

    “No reason why everyone should have an identical Claude experience”: Anthropic’s mods let you change Claude Code’s look and behavior

Topics and entities

Topics

Entities