Claude Code opened its nervous system to mods, and the plug-in gets your keys

THE SIGNAL IN ONE SENTENCE

Claude Code now has mods. That sounds like a pleasant Saturday afternoon until you read the permissions. Anthropic introduced the feature on October 1. A mod is a small JavaScript or TypeScript program that runs inside Claude Code and can hook into events across the agent loop. It can inspect or rewrite a prompt before the model sees it, block or retry a tool call, approve or deny a permission request, redact a secret from tool output, add interface controls or replace a built-in feature. That is a genuinely powerful extension system. It is also code running as you. Anthropic says this plainly in both the announcement and documentation. Mods are not sandboxed. They run with the same access to the machine as Claude Code itself. A loaded mod can read and write files available to the user account, start programs, make network requests, inspect environment variables and settings files, see prompts and tool calls, rewrite the session, submit a prompt, spend model usage and approve some tool calls before the user is asked. The plain signal is not that mods are secretly malicious. It is that Claude Code has opened a deep control surface to third-party code, and the security model begins with trusting the source. Extensions have always lived near this problem. A browser extension can read pages. An editor extension can read code. A package-install script can execute on a developer's machine. Claude Code mods add a twist because they sit inside an agent that already reads repositories, runs commands and asks for consequential permissions. The same hook that can stop a dangerous shell command can also change the command before it runs. The same hook that redacts a credential can read that credential. The same interface layer that shows an audit pane can restyle much of the interface around the decision. This is not hypocrisy. Security tools often need powerful access. It is a reminder that the guard and the thing being guarded occupy the same room. Anthropic designed mods around events. When Claude Code is about to call a tool, submit a prompt or draw part of the interface, it emits an event. A handler can observe the event, rewrite it, answer it instead of the normal behavior or wrap the next handler. Several mods can stack in load order. The first one loaded sees an event first on the way in and last on the way out. That ordering is not implementation trivia. It determines who can watch whom and who gets the final say. For managed environments, Anthropic supplies a built-in mod called sec-default. It loads first on Team and Enterprise plans and on machines with managed settings. Anthropic says it stops user-installed mods from doing risky things such as overriding permission denials. Administrators can load their own mods first, and the company tells them to include sec-default if they replace the default list. That is a useful policy anchor, but it does not turn an untrusted mod into harmless material. Anthropic's documentation still says a mod runs with the user's permissions, can read secrets and can start a process or network request. It also says the Bash sandbox does not contain processes that a mod starts. Sandboxing commands selected by the model is not the same as sandboxing the extension that decides what the model and interface are allowed to do. There are practical reasons developers will want this power. A team can show continuous-integration status beside a coding session, require confirmation before production configuration changes, count tool calls, keep an audit log or replace the built-in diff viewer. Anthropic moved its own /diff feature into the mod system and plans to move more built-in features there. The company also publishes sample mods. One previews the blast radius of a risky shell command. Another replays file edits from the previous turn. A context display tracks how much of the model's working window is full. These are exactly the sort of small, local improvements that make an extension ecosystem useful before it becomes enormous and strange. Installation follows the plugin path. A user can install from a marketplace with a command, load a local directory for one session or ask Claude Code to write a mod. Anthropic's announcement makes the last option sound delightfully easy: ask the coding agent to modify the coding agent, then hot reload the result. Ease is the feature. Ease is also why provenance matters. Before loading a mod, Claude Code can validate a downloaded plug-in directory and list the events it handles and the operations it requests, such as reading a file or making a network request. That is better than an opaque install. But a capability list is not a code review, a signature, a reproducible build or proof that the inspected files match what a marketplace later serves. A sensible organization should treat a mod more like a dependency with execution rights than a colorful theme. The first question is not whether it looks useful. It is who maintains it, how updates arrive, what code was reviewed and what happens if the maintainer account is compromised. The second question is scope. If a mod needs to draw a context meter, why does it also request file or network access? If it must send telemetry, which fields leave the machine, where do they go and how long are they stored? Anthropic exposes a mod API that makes requested operations visible, but teams still need an allowlist narrow enough to make that information useful. The third question is update control. Automatic extension updates are convenient until a trusted version changes beneath an approved review. Production teams should pin the reviewed commit or package version, keep a copy of the code, record its hash and promote updates through the same evaluation gate used for other executable dependencies. The fourth question is observation. Administrators need an inventory of loaded mods, their versions, sources, declared operations and actual behavior. An audit mod loaded first can record the calls made by later mods, according to Anthropic's design discussion. That record should leave the process and reach a system the mod cannot quietly rewrite. The fifth question is recovery. A safe mode disables user-installed customizations for a session, and settings can disable all user hooks more broadly. Teams should test those controls before an incident, keep clean profiles for sensitive repositories and know how to remove a marketplace or plug-in without losing the evidence needed to understand what happened. Individual developers can be more cautious without becoming extension hermits. Install from a source you can identify. Read the small mod. Run validation. Start in a disposable repository without production credentials. Watch its network traffic if it makes network requests. Avoid loading unknown mods into a session with customer data, signing keys, cloud credentials or a production shell. The user interface deserves special care. Anthropic says mods can redraw much of Claude Code's interface but cannot change the permission prompt or what that prompt shows. That protected surface matters. Users still need to recognize when they are looking at first-party controls, a mod's panel or content produced by the model. An extension system becomes dangerous when a convincing imitation is easier to build than the trust cues needed to distinguish it. There is a bigger product lesson here. Coding agents are becoming platforms. Once an agent has tools, memory, plug-ins, marketplaces and an event loop, familiar platform risks arrive too: dependency confusion, malicious updates, abandoned packages, overbroad permissions, confusing consent and trusted maintainers who get hacked. None of that means Anthropic should keep Claude Code closed. Extensibility lets teams adapt an agent to their actual work instead of waiting for one vendor to predict every workflow. It can also improve safety by placing organization-specific checks close to the action. The bargain works only when that power is visible, reviewable and revocable. Anthropic has made several useful choices at launch. The documentation does not hide that mods are unsandboxed. It explains what they can reach, provides validation commands, preserves a protected permission prompt, supports safe mode and gives administrators ways to restrict user-installed mods. The public design discussion began weeks before release, and sample code is available for inspection. The missing layer is an ecosystem record mature enough for routine trust. The public material does not establish a universal signing system, independent review program, reproducible package pipeline or fleet-wide behavior ledger for third-party mods. Marketplace controls help organizations decide where plug-ins may come from. They do not prove that everything from an allowed source remains safe forever. For now, the useful rule is refreshingly unfuturistic. A Claude Code mod is software. It can be delightful, tiny and written by an agent in one sentence. It is still software with the authority of the person who launched it. Open the nervous system if you want. Just keep the keys, the receipts and a working off switch.