Claude Code Mods: What They Are and the Risk

Anthropic shipped Claude Code mods on 1 October 2026. A mod is a small TypeScript function that hooks into the agent's internal events and changes what it does: rewriting a prompt before it goes out, adding a panel to the interface, wrapping a built-in handler, or replacing one outright. They ship inside plugins and install with the /plugin command in the CLI or the desktop app.

The three mods Anthropic published alongside the release give a fair picture of the range. Token Weather draws a sparkline of context-window usage over the last twelve turns. Blast Radius flags a risky shell command before it runs and lists what it would touch in a side panel. Replay Theater records the file edits made during a turn so you can step through them afterwards in a docked pane.

How Claude Code mods actually work

Mods register against internal events with a middleware signature of ($, e, next), where $ is the engine API covering the filesystem, HTTP, the UI and the process, e is the event payload, and next() passes control along the chain. A documented event is tool:before, which fires before a tool call executes and is how Blast Radius catches a bash command on its way out.

Because handlers chain, a mod can run before the original, after it, instead of it, or around it. That last option is the one that makes mods more than a plugin system. A mod is not extending the agent at the edges, it is sitting in the middle of its execution path.

The APIs are marked early access and may change between releases without notice. The practical consequence is that you regenerate the TypeScript declarations with /plugin-types after every upgrade, and you should expect a mod written today to need attention.

The part that deserves your attention

Mods run in the same process as Claude Code, unsandboxed, with the same access to your machine that Claude Code itself has. Anthropic says this plainly and advises installing only from trusted sources.

Read that again with the installation path in mind. Mods arrive through plugins, plugins come from a directory, and the thing you are installing can read your filesystem, make network calls, and draw whatever it likes in the interface. The failure modes are not exotic: credential exfiltration, interface spoofing that shows you one diff while another is applied, payload injection after you have reviewed something.

There is one guardrail, and it is not available to everyone. A built-in mod called sec-default loads first in the handler chain and stops user-installed mods from overriding permission deny rules. It ships to Enterprise and Team plans. On a personal plan it is not there, which means every community mod you install is code running with your privileges and nothing structurally preventing it from turning off the checks you rely on.

This is the same shape of problem as any plugin supply chain in a coding tool, with the difference that the attack surface is the agent's own decision path rather than your build.

What this is good for

Set the risk aside for a moment, because the capability is real.

The most obvious use is making the agent's state legible. Agents fail quietly, and most of the frustration of working with one comes from not seeing what it is about to do or what it just did. Token Weather and Replay Theater are both answers to that, and the pattern generalises: anything you currently infer by watching output scroll past is something a mod could surface directly.

The second use is enforcing a team's conventions in the place where they actually bind. You can already steer an agent with an AGENTS.md file and shape what it may do with per-team permissions. A mod operates a layer below both: it can inspect the concrete tool call and refuse it, rather than hoping instructions were followed. Organisations can allow or block marketplaces and push mods to every developer's environment, so this is deployable as policy and not just as personal configuration.

A sensible posture

Treat a mod the way you would treat a dependency with no sandbox, because that is what it is.

Read the source before you install it. Prefer mods that only add interface, since a mod that reads events and draws a panel has a much smaller blast radius than one that rewrites prompts or replaces handlers. If you are on a personal plan, be aware that nothing is enforcing your permission rules underneath. And if you are deploying across a team, the org-wide controls are the point: decide centrally which marketplaces are allowed rather than leaving it to whoever is curious.

The feature is a good one. The access model is the thing to be deliberate about, and the honest summary is that the convenience and the risk come from exactly the same design decision. If you want a wider view of how the tools compare on this kind of extensibility, the Claude Code, Cursor and Codex comparison covers the ground, and the AI coding tools guide is the broader map.

Sources: Crypto Briefing, byteiota