Claude Code mods are not sandboxed, and version 2.1.289 fixes a deny rule they could override

Anthropic announced mods for Claude Code on October 1, 2026. They require version 2.1.287 or later, and they are on by default. A mod is a function that Claude Code calls when an event happens, such as a tool call, a submitted prompt, or part of the interface being drawn. The two releases that followed the announcement, 2.1.288 and 2.1.289, include fixes for permission rules that a mod or a shell command could get around.

What a mod can change

Each time Claude Code does something, it emits an event. A mod hooks into an event and can run before it, after it, or instead of it. According to the announcement, one function can rewrite a prompt before it reaches the model, and it can block, rewrite, or retry a tool call. It can also approve or deny a permission request and redact secrets from tool output before Claude reads it.

A mod can also draw. It can add a pane beside the transcript or a band above the prompt, with buttons and text fields, and it can replace parts of the interface that Claude Code draws itself. The documentation names one exception: a mod cannot change what a permission prompt shows you. When several mods handle the same event, they run in the order they load.

Some built-in features now ship as mods. The /diff command is one of them, and you can turn its mod off in /plugin or replace it with your own version. Anthropic says it plans to move more built-in features to mods over time.

What a mod can reach on your machine

Anthropic states the risk directly: mods are not sandboxed, and they run with the same access to your machine as Claude Code itself. The documentation lists what a loaded mod can do:

• It can read and write files anywhere your user account can, start programs, and make network requests.
• It can read environment variables and settings files, including an API key you keep in either.
• It sees every prompt you send and every tool call Claude makes, and it can rewrite them.
• It can approve a tool call before you are asked.
• It can call a model on your plan or API key.

How to inspect a mod and turn mods off

If you turn on sandboxing, the sandbox isolates the Bash commands Claude runs, but a process that a mod starts runs outside it. Before you install a mod, you can run claude plugin validate on its directory. The hooks: and calls: lines in the output list the events the mod handles and what it asks Claude Code to do, and the mod itself does not run.

You can disable a single mod from the Installed tab in /plugin. The --safe-mode flag stops every installed mod for one session, along with your other customizations. Setting "disableAllHooks": true in ~/.claude/settings.json stops every mod you installed, in every session. That setting also stops your settings hooks and your custom status line. None of these options stops the built-in mods.

A mod's hooks also run where nothing is drawn: in the VS Code extension's chat panel, in claude -p, and in the Agent SDK. Only the terminal and the Code tab of the Claude Desktop app show what a mod draws.

What organizations get

Mods ship inside plugins, so existing plugin controls apply, and administrators can allow or block plugin marketplaces. On Team and Enterprise plans, and on any machine with managed settings, a built-in mod called sec-default loads first. Anthropic says it stops mods that users install from doing risky things, such as overriding permission deny rules.

Administrators can load their own mods first instead. Anthropic advises adding sec-default to that list to keep its restrictions. The managed setting allowManagedModsOnly stops the mods a user installed and leaves the rest of each plugin loaded.

What versions 2.1.288 and 2.1.289 fix

Anthropic released version 2.1.288 on October 2, 2026, and version 2.1.289 on October 3, 2026. Most entries in both releases are small fixes. Several of them concern permission rules:

• 2.1.289: a deny or ask rule on a nested part of a compound shell command now holds over a user-installed mod's approval on managed machines.
• 2.1.289: Read deny rules now apply to files that are @-mentioned, changed, or selected in the IDE through a symlink.
• 2.1.289: a user-installed plugin can no longer rewrite the descriptions of sign-in tools that belong to an organization-managed Model Context Protocol (MCP) server.
• 2.1.289: Bash deny and ask rules no longer miss a command that follows an environment variable prefix or a bare variable assignment when the sandbox auto-allows commands.
• 2.1.288: a dangerous rm inside a bash -c or sh -c script no longer runs without a prompt in bypassPermissions mode or under a shell allow rule.
• 2.1.288: when a PreToolUse or PermissionRequest hook cannot be matched, or the tool's input cannot be serialized to JSON, the call is now blocked instead of the hook being skipped.