Anthropic Launches Claude Code Mods, TypeScript Agent Hooks
TL;DR
- Mods run with identical machine privileges to Claude Code itself and are explicitly unsandboxed, so the security bar for any installed mod equals that of any locally installed program.
- Anthropic converted three of its own built-in features, the diff pane, agents.md loader, and telemetry, into mods at launch, establishing first-party precedent and marking the system as load-bearing rather than experimental.
- Mods execute as an onion-style middleware chain in registration order, making load sequence and inter-mod trust exploitable once a hostile mod enters the chain.
Anthropic introduced "mods" on October 1, small TypeScript functions that hook into Claude Code's internal events and change what the agent does. In the launch post, the company writes that "a mod can rewrite a prompt, add new UI, replace a built-in feature, or add entirely new functionality."
The hook surface runs across the agent loop. Mods can rewrite a prompt before it reaches the model, block or retry a tool call, approve or deny a permission request, redact secrets from tool output, and edit or replace interface elements. "When several mods hook the same event, they run in the order they load," the post says; "the first mod to load sees the event first and the result last." Anthropic says the existing `/diff` feature now ships as a mod, which users can disable or replace the same way as any third-party extension.
Mods ride inside plugins and install via the `/plugin` command, with support in both the CLI and desktop app. They are not sandboxed. The post is blunt about what that means: "Mods run with the same access to your machine as Claude Code itself. They aren't sandboxed, and you should only install mods from sources you trust, the same way you'd install any code on your computer." Team and Enterprise plans load a built-in mod called `sec-default` first, intended to prevent risky actions like overriding permission denials.
It is the latest in a steady run of Claude Code and plugin releases moving through our coding-tools tracker, landing a day after a separate Anthropic enterprise pricing story. You can write a mod yourself, the company says, "or ask Claude Code to write one for you."
What others are reporting
-
DEV Community Read →
Frames install hygiene as agent infrastructure, not an add-on; shows Blast Radius is a cooperative safety net that load order and chain position can defeat, not a hard boundary.
Mods run with the same access to your machine as Claude Code; they are not sandboxed; install only sources you trust.
-
AlphaSignal Read →
Details how Blast Radius veto hooks can be evaded via shell substitutions and covers sec-default administrative mods needed to enforce guardrails at the enterprise level.
Mods run with the same access to the machine as Claude Code. They are unsandboxed and should receive the same scrutiny as any locally installed program.
-
Crypto Briefing Read →
Names three live reference mods (Token Weather, Blast Radius, Replay Theater) with concrete use cases, grounding the extensibility story in already-shipped examples.
Mods are distributed inside plugins and installed using the /plugin command in the command-line interface or desktop application.
-
4SAPI Blog Read →
Technical deep-dive with code samples; maps the onion middleware chain, contrasts Function Hooks vs Classic Hooks, and recommends retaining Classic Hooks as an enterprise fallback.
Multiple Mods execute in registration order, forming an onion-style middleware chain similar to routing middleware in Express or Koa web frameworks.
-
NeuryCode Read →
Maps five early open-source mods already circulating, frames which teams should adopt now vs. wait, and argues source-code inspection matters more than footprint size.
A Mod is a Claude Code plugin that uses function hooks.
Originally reported by claude.com
Read the original article →Original headline: Anthropic Launches Claude Code Mods, TypeScript Functions That Rewrite Prompts, Tool Calls, and UI