Anthropic introduced mods for Claude Code on 2026-10-01: “small TypeScript functions that change how Claude Code works.” A mod hooks into the events Claude Code emits, such as a tool call, a permission request or drawing part of the screen, and can run before the event, after it, instead of it, or wrapped around it. With one function a mod can rewrite a prompt before it reaches the model, block, rewrite or retry a tool call, approve or deny a permission request, or redact secrets from tool output before Claude reads it. Mods can also edit or replace parts of the interface and add buttons and inputs, in the terminal, the desktop app or both.
Mods ship inside plugins, so they are installed and shared the same way, and Claude Code can write, install and hot-reload a mod on request. Anthropic positions them as going beyond hooks, which “can’t rewrite events, draw new UI, or replace features.” Some built-in features now ship as mods, starting with /diff, which users can turn off or replace, and Anthropic says it plans to move more built-ins to mods so users can “pare Claude Code down to a small core.” The design was shared on GitHub for feedback before launch.
Anthropic is explicit about the risk: “Mods run with the same access to your machine as Claude Code itself. They aren’t sandboxed.” For Team and Enterprise plans and managed machines, a built-in mod called sec-default loads first and stops user-installed mods from doing risky things such as overriding permission deny rules; admins can also allow or block plugin marketplaces.
Why it matters: it turns the coding agent’s own harness into a programmable surface, so permission policy, UI and even core features become user code. That is a large gain in control and a new supply-chain attack surface at the same time. What it does not show: the announcement gives no data on adoption or on how well sec-default resists a malicious mod, and protection for individual users outside managed settings rests on installing only trusted code.