Claude Code 2.1.287 Turns On "Mods" by Default: Unsandboxed In-Process Plugins That Can Read the API Key

Claude Code users on the latest npm release channel

Claude Code 2.1.287, published to npm on October 1, 2026, enables mods by default: JavaScript and TypeScript plugins that run inside the Claude Code process. Anthropic's documentation states that mods "aren't sandboxed," can "read and write your files, start processes, and make network requests," and can "read your secrets: environment variables and settings files, including an API key you keep in either." Bash sandboxing applies only to commands Claude runs, not to processes a mod starts. Before release, Pluto Security showed a pre-release mod silently reading `~/.claude/.credentials.json` and prompt history, rewriting a "Delete ALL files" confirmation in the UI, and appearing as "Hooks (0)" in plugin details, and dash.security demonstrated a mod swapping Bitcoin wallet addresses from inside the process. The stable tag remained on 2.1.285 at publication

An extension mechanism that runs third-party code with the agent's full privileges and secrets in the same process, with review based on what the plugin declares rather than what it does