Claude Code mods run unsandboxed with your user permissions

Since Claude Code 2.1.287, plugins can ship mods — JavaScript or TypeScript that runs inside the Claude Code process and is enabled by default. A mod can read files and environment variables including API keys, see every prompt and tool call, and approve tool calls over permission rules; sandboxing isolates Claude's Bash commands but not processes a mod starts.

• Mods arrived in Claude Code 2.1.287 and are on by default
• A mod can approve a tool call that a deny rule refuses outside managed settings
• The sandbox isolates Claude's Bash commands, not processes a mod starts
• CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=0 no longer disables mods