Anthropic Launches Claude Code Mods for Custom Agents

On October 1, Anthropic shipped Claude Code v2.1.287 with a feature called Claude Code Mods: small TypeScript or JavaScript functions that hook into the coding agent's internal events and change what it does. In the launch post, the company says a single mod can rewrite a prompt, add new interface elements, replace a built-in feature, or add entirely new functionality, as reported by AI Weekly.

The hook surface spans the agent's execution loop. Mods can rewrite a prompt before it reaches the model, block or retry a tool call, approve or deny a permission request, redact secrets from tool output, and edit or replace interface elements. When several mods attach to the same event, they run in load order, with the first-loaded mod seeing the event first and its result last — an onion-style middleware chain familiar to anyone who has built services with Express or Koa.

Mods ship inside plugins and install through the /plugin command in both the CLI and the desktop app. Three of Anthropic's own built-in features — the diff pane, the agents.md loader, and telemetry — were converted into mods at launch, a signal that the system is load-bearing rather than experimental. Developers can write their own, or ask Claude Code to write one for them.

The unsandboxed catch

Here is the part Anthropic is blunt about: mods run with the same machine access as Claude Code itself, and they are not sandboxed. The launch post advises installing mods only from sources you trust, the same way you would install any code on your computer, as a dev.to analysis of the release emphasized.

For Team and Enterprise plans, a built-in security mod called sec-default loads first in the chain, which is intended to stop later mods from casually overriding permission denials. Anthropic also ships a plugin validate command for inspecting plugins and a safe-mode flag for disabling hooks in sensitive repositories.

Still, the resemblance to early npm is hard to miss: an open distribution model with no mandatory review, no signing, and no sandbox. One analysis pointed to a study of more than 31,000 agent skills that found over a quarter carried at least one security vulnerability — and mods have deeper access than skills. Enterprise teams get a further lever: private marketplaces distributed from a Git repository, pinned to specific commit SHAs, so every developer runs the same approved plugin set.

Why it matters beyond coding tools

The release landed in the same week the head of Claude Code, Boris Cherny, announced on X that Sonnet 5.5 runs 30 percent faster with 30 percent less usage — a pairing that makes real-time interception by mods more viable, according to VibeLeaderboard's intel brief.

Community reception was immediate. Cherny's announcement post drew hundreds of thousands of views, and within hours developers had a game of Tetris running inside the Claude Code terminal. Early example mods circulating in the community include Token Weather, which forecasts remaining context window with a sparkline of recent turns; Blast Radius, which catches risky shell commands before they run; and Replay Theater, which records every file edit in a turn for step-by-step review.

Anthropic also released its first official mod plugin, called You Should Know, which spins up a side agent that watches Claude's output and sends a heads-up message when it spots important information a user might have missed, according to The Decoder. Anthropic provides sample mods on GitHub, and the same report notes that mods work in the CLI, the desktop app, and partly in the VS Code extension — but run with the user's permissions, so organizations get controls over which mods are allowed to load.

The bigger signal sits on GitHub Trending. As of October 3, ten of the fifteen trending repositories were agent skills, harness optimizers, or multi-agent orchestration tools — several with six-figure star counts. Mods add a fifth layer to the agent stack: Claude Code Mods are runtime middleware that can reshape the agent itself, as covered by The Arabian Post.

What teams should do now

For individual developers, the prudent path starts with Anthropic's built-in mods to learn the middleware pattern before installing third-party ones, running validation on every plugin and reading hook source before enabling it on a machine with credentials.

For teams, the playbook is to stand up a private marketplace with an approved plugin set, treat third-party mods the way you would treat npm packages from unknown authors — vendored, audited, version-locked — and keep a security mod first in the load order.

The launch also sharpens a question the agent ecosystem keeps circling: if the harness is becoming the product, who builds the trust layer? Anthropic's bet is that openness drives adoption faster than curation — the same bet VS Code extensions and npm made, and all of them eventually needed security layers on top. The commit-pinning infrastructure for that governance already exists; the policy layer is what is missing. For ongoing coverage of the agent ecosystem, see our AI News section, and for the agent-commerce side of the same trust story, our report on Beltic's $7.3M know-your-agent raise.