Claude Code's new mods run with your permissions and can approve the call your deny rule refused

That line sits near the top of Anthropic's documentation for Mods, the Claude Code extension system the company published on October 1 12. The pages that follow spend several screens explaining exactly how much that sentence means, in more detail than most vendors volunteer. Read them closely and you get a picture of a feature, an architecture, and the one place where the two stop agreeing.

A mod is a Claude Code plugin whose behaviour lives in a JavaScript or TypeScript module. Claude Code calls the module's handlers when a tool is about to run, when you submit a prompt, when a turn starts or ends, and when each piece of the interface is drawn. A handler can watch the event, rewrite it, or answer it itself and skip the usual behaviour 1. Mods need Claude Code 2.1.287 or later, and they are on by default.

The feature exists because the older extension points stop at the agent's edge. Settings hooks, skills and MCP servers each run a script or hand Claude text or tools. A mod runs inside the Claude Code process, which is how it can draw a pane beside the transcript, hold a shell command while it shows you what that command would delete, or answer a slash command without a model turn at all. Anthropic's developer blog builds one in about eighty lines, the company publishes three sample mods, and the source of its own built-in ones is public 34. One caveat arrives with the release: the API can change between versions 2. The feature serves developers who want Claude Code fitted to their own workflow, and it lands with the administrators who have to approve that.

Six capabilities, in the documentation's words. A mod can act on your machine as you, reading and writing files anywhere your account can and starting programs. It can read your secrets, meaning environment variables and settings files, including an API key kept in either one. It can see your session, every prompt you send and every tool call Claude makes. It can change your session, rewriting a prompt or a tool call, submitting a prompt as though you had typed it, or sending a message to another of your sessions. It can act without asking you, approving a tool call before you are asked. And it can spend your usage, calling a model on your plan or your API key 1.

That is an accurate description of a plugin that runs in your process with your privileges, and Anthropic put all six items on one page under a heading about trust. The sentence that matters comes a paragraph later. "A mod that approves tool calls can approve one that an ask rule would prompt for, or that one of your own PreToolUse hooks blocked," the page says, and links onward to a section covering when a mod can approve a call that a deny rule refuses 1.

The deny list is the strongest statement a developer can make inside this product. Permission rules are evaluated in a fixed order, deny first, then ask, then allow, and the first match decides; a broad rule like Bash(aws *) blocks every matching call, and a narrower allow rule cannot carve an exception out of it 5. A mod can approve the call anyway.

It does that without touching the dialog. "A mod can restyle much of Claude Code's interface, but not the permission prompt," the same page says. "It can't change what a prompt shows you" 1. The prompt still reads exactly as it always did. It simply never comes up.

Follow that split through the rest of the documentation and the shape becomes concrete. Claude Code's Bash sandbox is off by default, and it wraps shell commands only. Command hooks, MCP servers, plugin monitors, language servers, your status line command and apiKeyHelper all run outside it with your full access 7. Inside the sandbox, commands may read most of the machine by default, credential files such as ~/.ssh and ~/.aws/credentials included, while only their writes are restricted. Every enabled plugin's bin/ directory is added to the PATH of the Bash tool's shell, so Claude can run anything sitting there 6. And installing a plugin enables it.

The mod's own code is fenced off from the host in one respect worth stating. The module runs in a restricted JavaScript environment with no DOM and no Node, so anything it does beyond itself goes through the mods API. That API is where the reach comes from: it runs processes, touches files, makes network requests, calls models, and registers commands. A process a mod starts lands outside the sandbox, which the Mods page says in as many words 1.

So the boundary in this product is drawn around the model's tool calls, and the extension code sits on the far side of it. That placement is deliberate. An extension that could not start a process or read a file could not do the job the feature was built for.

Anthropic did ship off switches, and the more useful question is what each one actually reaches.

Every row of that table comes from the Mods documentation 1. The clause underneath the table undoes most of its tidiness: the settings and flags that stop installed mods, disableAllHooks, --bare and --safe-mode among them, do not stop built-in mods 1.

Claude Code's own features are mods now, and the documentation lists them by name. /diff is a mod that can be disabled. The AGENTS.md loader is a mod. Telemetry is a mod. cc-plugin-sec-default, the guard that keeps user-installed mods away from what your organization manages, cannot be turned off by a user at all. cc-plugin-you-should-know, which "runs a side agent that watches your back while Claude works on longer tasks", starts off and takes one command to enable 1.

Two smaller facts change what a security team can see. When auto-update is on for a marketplace, Claude Code updates plugins in the background, so the files somebody reviewed can change on disk afterward 6. And if an organization exports Claude Code's telemetry, community and third-party plugins are reported as the literal string third-party unless OTEL_LOG_TO_TOOL_DETAILS=1 is set; the plugin-installed event leaves the name fields out entirely for anything outside Anthropic's own marketplaces, and the analytics API does the same 6.

Against that, credit where it is due. claude plugin validate reads a plugin's manifest and source without running it, and prints the events its mod hooks and what it asks Claude Code to do, including files it reads and network requests it makes 12. Few extension systems of this kind hand you a static analysis of a plugin as a first-class command.

Anthropic built a scanner for third-party extensions before it shipped Mods, so it is worth reading on its own terms. Skill and plugin scanning checks third-party skills and plugins when a member uploads or edits one, returns pass, warn or fail, and turns on by default for Enterprise organizations that have not set it on October 2, 2026. It runs at no extra cost 9.

The same page lists what it passes over. Extensions already in the organization when scanning was switched on. Skills a member creates with Claude. Skills shared through a connected MCP server. Organizations running customer-managed encryption keys, zero data retention or HIPAA configurations, which install extensions with no scan at all. And, in the page's own words, "MCP servers and hooks, which aren't scanned at this time" 9.

Mods are hooks. The Mods page says so directly, explaining that Claude Code calls both kinds hooks, and the developer walkthrough repeats that a mod is a hook that ships inside a plugin 12. The scanner built to inspect extensions leaves the kind Mods are outside its scope.

Two outside data points fill in the rest of the picture, both from the security firm Air Security. In September the firm published Plugin4Shell, a zero-click remote code execution in the plugin distribution layer shared by Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. Each agent checked out the commit a marketplace had pinned and never verified that the checkout landed there, so an attacker controlling a plugin's repository could serve different code while the pin still looked honoured, and background auto-update delivered it with no click 8. Anthropic confirmed the fix in Claude Code 2.1.179 and OpenAI patched Codex in 0.146.0. Microsoft had shipped nothing at the time of writing, and Google retired the Gemini CLI rather than patch it 8.

Days later the same researchers published their attempt on the scanner. They ran thousands of skills through it and got malicious ones marked safe, because the check is a one-time static pass that follows no external links and sandboxes nothing. One real in-the-wild skill pointed at an unclaimed package name on PyPI and passed 10. Anthropic's own page concedes a version of the same limit from the other direction: a pass "isn't a guarantee that a skill is safe in every respect", and the scan "won't catch a skill that behaves in ways you didn't intend without being malicious" 9.

Plugin4Shell itself is closed. What the record establishes is where this product has put its trust: in the marketplace, in the pin, and in a single pass over a file at upload time.

There is no price for the extension system, and nothing to buy. The bill arrives through two entries already on the list. A mod can call a model on your plan or your API key, and it can start a process.

The first-party example shows what that costs in practice. cc-plugin-you-should-know runs a side agent that watches Claude work on longer tasks, and shows a note above the prompt when it finds something worth flagging 1. A side agent is a second model loop against your usage. It ships disabled and takes one command to turn on, so it will not surprise anybody. It is also the demonstration Anthropic chose for its own extension system: one agent watching another, both metered.

For a team pricing this out, the numbers are published. Claude Code's cost documentation puts enterprise deployments at roughly $13 per developer per active day and $150 to $250 per developer per month, with 90% of users staying under $30 per active day 11. Access itself runs $17 a month for Pro on annual billing, from $100 a month for Max, and $20 per seat per month on Enterprise with usage billed at API rates on top 12.

Mods are a well-built feature with a clear job, and for one developer on a personal plan they are close to free to try. The API is documented line by line, the sample mods are public, and claude plugin validate will tell you what a mod hooks before you load it. On a machine holding a throwaway repository and a subscription, a mod that can approve the call your deny rule refused is a smaller exposure than the shell history in the same folder.

The judgment changes with the size of the account, because three facts compound on a fleet. The permission rules a security team writes to constrain the agent stop at the agent, and the code the agent loads keeps going. The switch that turns mods off leaves Anthropic's own running. And the log that would name the third-party mod that loaded reports the string third-party unless somebody set one environment variable.

The condition, then. Before Mods go onto a machine that holds credentials, fix the marketplace list your team may install from, confirm skill and plugin scanning is on, set OTEL_LOG_TO_TOOL_DETAILS=1 so the logs name what loaded, and treat claude plugin validate as the review step a person performs rather than a check that performs itself. Done that way, Mods are a good feature and worth the install. Skipped, you have handed every plugin author on your team the same permissions you hold, and filed the result under permissions.