AI Insights · Oct 23, 2026 · Verified

Claude Code mods run outside the sandbox

A mod is a plugin whose code runs inside Claude Code itself, with your permissions. That makes mods powerful, and it means the sandbox does not protect you from them.

Claim

A mod is a Claude Code plugin whose JavaScript or TypeScript handlers run in Claude Code's own process. It can rewrite or approve tool calls and message other sessions, and it is not covered by the Bash sandbox. Dan McAteer argues this is an early "Attention Interface": a harness that faces the human instead of the machine. That framing is opinion; the mechanics are documented.

Evidence

Docs (primary, fetched 2026-10-24):

  • "A mod is a plugin that changes how Claude Code looks and behaves."
  • "Mods aren't sandboxed. If you turn on sandboxing, the sandbox isolates the Bash commands Claude runs, and a process that a mod starts runs outside it."
  • A mod can "Read your secrets: environment variables and settings files, including an API key you keep in either", "send a message to another of your sessions" and "approve a tool call before you're asked".
  • "Mods are on by default. In the terminal, use Claude Code v2.1.287 or later."
  • Off switches: --safe-mode for one session, "disableAllHooks": true in settings for all installed mods; built-in mods are not stopped by either.
  • A WSL session in the Desktop app: hooks do not run "because plugins aren't available in WSL sessions".
  • Review before install: claude plugin validate ./some-mod lists the hooks: and calls: of a mod.

Essay (McAteer, 2026-10-21):

  • "Claude Mods are an early version of the Attention Interface, and one you can shape yourself."
  • "Claude Mods are middleware for the agent harness." and "Claude Mods let you reverse the direction of the harness."
  • "Since I installed it on October 15, 99 of my 111 turns in Claude Code met that bar." (his own supervisor mod; one user)
  • "the mod's own README estimates about 5–6k input-equivalent tokens per check on a 50k-token session."

Open questions

  • Which of the five machines run v2.1.287 or later, and which have a mod installed.
  • Whether the sandbox gap is closed later; the docs state it as current behaviour.

Sources

AI-assisted research: gathered and summarised with AI from the sources above, each claim checked against them.

Related

Book a demo