Claude Code mods run unsandboxed and can alter permission checks

What happened

Anthropic introduced mods for Claude Code this week. A mod is a small TypeScript function that changes how Claude Code behaves. According to Anthropic, a mod can rewrite a prompt, add new screen elements, replace a built-in feature, or add new functionality. It works in the Claude Code command-line tool and the desktop app.

The mechanism is simple. Each time Claude Code does something, such as calling a tool, asking for permission, or drawing part of the screen, it emits an event. A mod hooks into one of those events. It can run before the event, after it, or instead of it.

Anthropic says hooks, the older customization option, can’t rewrite events, draw new UI, or replace features. Mods can. You can write one yourself or ask Claude Code to write it for you. Mods ship inside plugins, so you install them like any plugin, including through the /plugin command.

Why it matters

The upside is control. Anthropic lists examples like blocking or rewriting tool calls, approving permission requests, and redacting secrets from output. A mod can enforce a local rule before a command runs. That protection depends on the code you install.

The risk sits in the same sentence. Anthropic states that mods “run with the same access to your machine as Claude Code itself” and “aren’t sandboxed.” A sandbox is a restricted box that limits what a program can touch. Without one, a mod can read your files, see your commands, and reach the network as you.

A mod that sees every event also sees every prompt and tool call. A malicious one could quietly rewrite a command, or approve a permission request you never saw. That is the failure mode: your safety checks themselves become something a stranger’s code can change.

Anthropic says sec-default, a built-in security mod, loads first on Team and Enterprise plans and on machines with managed settings. It restricts risky behavior, including overrides of permission deny rules. Admins who replace the default mod order must retain it to keep those restrictions.

Who should care

Anyone who installs plugins from a directory or a repository. Mods ride on the plugin system you may already use, so a plugin you trust today could ship one later. If you only use Claude Code as it comes, nothing changes.

What builders should do next

Treat a mod like any program you would download and run. Anthropic’s own advice is to install only from sources you trust.

Read the mod’s source before installing it. You can ask Claude Code to help identify process launches, file access, and network requests, but its review is not a guarantee that the code is safe.

A throwaway project on your usual computer does not isolate an unsandboxed mod. Test new mods on a separate disposable machine or virtual machine without personal files or production credentials. Avoid shared folders that expose your usual computer’s data.

In that isolated environment, run an ordinary task with and without the mod. Check whether expected approval prompts still appear. Treat unexpected behavior as a reason to stop, not as proof that the remaining code is harmless.

End of article