agent-postmortems a structured database of real AI-agent failures

← all incidents

hazard moderate confidence: confirmed status: factual

Claude Code enabled unsandboxed in-process plugins (Mods) by default

2026-claude-code-mods-unsandboxed-default · 2026-10-01

Claude Code v2.1.287 turned on "Mods" by default: JavaScript/TypeScript plugins that run inside the Claude Code process with the user's privileges. Per Anthropic's own documentation, a loaded mod is not sandboxed and can read secrets such as API keys from environment variables and settings files, and can approve tool calls before the user is prompted. Disclosed as a capability/safety posture; no exploited-in-the-wild case reported.

System

Framework
Claude Code
Tools
claude-code-plugins, claude-code-mods
Vendor
Anthropic
Autonomy
supervised-autonomous

Classification

Primary class
supply-chain-compromise
Chain
supply-chain-compromise/extension → excessive-agency/missing-approval-gate → data-exfiltration/via-tool
Attack vector
supply-chain
Causation
entity: human · intentionality: unintentional · timing: post-deployment

Trigger

Installing or loading a mod — a plugin made of JavaScript/TypeScript event handlers — causes it to run inside the Claude Code process with the user's privileges. From v2.1.287 (terminal) and v2.1.286 (Desktop app), mods are enabled by default, so the subsystem is active unless explicitly turned off.

Root cause

Mods execute in-process by design rather than in a sandbox, so they inherit the user's full privileges: reading and writing files, starting processes, making network requests, and reading environment variables and settings files that may hold API keys. The same in-process position lets a mod observe and rewrite session events, including approving a tool call; absent managed settings or a Team/Enterprise login, a mod's approval can pass a call that an ask rule or a PreToolUse hook would otherwise stop.

Contributing factors

  • Mods run inside the Claude Code process; the Bash sandbox, if enabled, does not contain a process a mod starts.
  • The plugin-install trust model equates to running third-party code, comparable in risk to an npm install.
  • On accounts without managed settings, a mod can approve tool calls that ask rules or PreToolUse hooks would otherwise gate.
  • The mods subsystem is enabled by default, so the capability is present without an explicit opt-in.

Detection

Documented by Anthropic in the official Claude Code docs, which enumerate what a mod can reach and state that mods are not sandboxed and are on by default. Independent security writers analysed the change and framed it as a supply-chain attack surface.

Recovery

Not an in-the-wild incident; no remediation event. Anthropic documents controls to limit or disable mods: disabling or uninstalling a plugin, --safe-mode, disableAllHooks, and the organization-level allowManagedModsOnly.

Prevention

Install mods only from trusted authors and marketplaces; review a mod's hooks and calls with claude plugin validate before loading; pin versions to prevent silent updates; for organizations, enforce allowManagedModsOnly and managed settings so user-installed mods cannot override permission gates; use --safe-mode or disableAllHooks where in-process extensions are not needed; keep long-lived credentials out of environment variables and plaintext settings.

Blast radius

Data
A loaded mod can read secrets, including API keys, from environment variables and settings files, and can make network requests. No disclosed exposure of a specific user's credentials; this records the documented capability, not a breach. credentials
User harm
No realized harm reported. The hazard is the expanded attack surface: an in-process third-party extension with access to secrets and the ability to approve tool calls before the user is prompted. none-reported
Scope
Claude Code installs with mods enabled by default (terminal v2.1.287+, Desktop app v2.1.286+)
Reversibility
unknown

Timeline

  • 2026-10-01 Claude Code v2.1.287 published to npm, enabling mods by default in the terminal.
  • Anthropic documentation states mods are not sandboxed and lists their access to secrets, sessions, and tool-call approval.

References

OWASP LLM
LLM02 LLM03 LLM06
OWASP Agentic
T3
MITRE ATLAS
AML.T0024
Related
2025-amazon-q-wiper-supply-chain
Tags
claude-code plugins mods sandboxing attack-surface api-keys approval-bypass

Sources

Cite this incident

Permalink: https://swarmproof.github.io/agent-postmortems/2026-claude-code-mods-unsandboxed-default/

@misc{2026-claude-code-mods-unsandboxed-default,
  title = {Claude Code enabled unsandboxed in-process plugins (Mods) by default},
  year = {2026},
  howpublished = {agent-postmortems},
  url = {https://swarmproof.github.io/agent-postmortems/2026-claude-code-mods-unsandboxed-default/}
}