Claude Code, explained: what changed this week, and a real bug fix in four turns

Claude Code is a coding tool from Anthropic that you mostly use in a terminal, the text window where you type commands. You describe a task in plain words, and Claude, Anthropic's AI model, does the work on your project.

It is an agent. An agent is an AI model that does more than answer: it takes actions one after another, such as reading a file, running a command or editing code, and looks at each result before choosing the next step. Anthropic's docs call the program around the model "the agentic harness": it gives the model its tools and decides what the model gets to see.

Three things put it in the news this week. On 1 October 2026 version 2.1.287 shipped with the line "Added Claude Mods: plugins may now modify deeper behavior". On 22 September version 2.1.280 made Claude Opus 5.5 the default Opus model, at $4 per million input tokens and $20 per million output tokens. And on 3 October Anthropic's guide "Getting the most out of Opus 5.5 in Claude and Claude Code", first published on 22 September, was posted to Hacker News, where it had 219 points and 150 comments when I checked.

It also changes fast. The project's GitHub releases list version 2.1.288 on 2 October and 2.1.289 on 3 October, with 58 and 23 fixes.

A plugin is a package that adds something to Claude Code, such as new commands, skills or connections to other services. A mod is a plugin with a difference: it contains JavaScript or TypeScript functions that Claude Code calls from the inside when something happens.

Why does that matter? The older ways to extend Claude Code work from the outside. A settings hook runs a shell script at a set moment, and an MCP server (a separate program that connects Claude to another service using the Model Context Protocol) gives the model extra tools. A mod runs inside the program, so it can watch an event, change it, or take it over.

Anthropic's docs list what a mod can do: draw its own panes and buttons, redraw parts of Claude Code's own screen, hold a tool call while it asks you a question, answer a tool call without running the tool, send one request to a different model, and add a command that runs your code at once.

Anthropic shares three sample mods. token-weather draws a forecast of how full your context window is. blast-radius holds a risky shell command such as rm -rf (delete a folder and everything in it) or a force push (overwriting the shared copy of a git branch) and shows what it would change, with buttons to go ahead or cancel. replay-theater steps through the file edits Claude made in the last turn.

The idea was tested in public first. GitHub issue #91870, opened on 3 September 2026, says "I was asked to get feedback from the community regarding an internal proposal we have", and called the feature "function hooks". An update on 9 September named it Claude Mods and let people try it behind a switch. Mods then shipped in 2.1.287. They need version 2.1.287 or later and are on by default.

Before the clean run, I ran the same prompt and recorded every event. The log for that run reports permissionMode bypassPermissions, and Claude fixed the file with sed -i, a shell command that edits files. That command was not on my allow list, and it ran anyway.

A permission mode is the rule that decides whether Claude asks before it acts. Bypass mode skips the approval prompts altogether, so an allow list has nothing left to allow. That run happened in a throwaway folder, so nothing was at risk, but it is exactly the mistake that goes unnoticed, because the bug still got fixed.

Anthropic's docs are blunt about it: "Only use this mode in isolated environments like containers or VMs where Claude Code can't cause damage." A container or a VM (virtual machine) is a walled-off computer inside your computer.

So I ran it again with --permission-mode default, which asks before anything not allowed, and --setting-sources project, which ignores settings from outside the project folder. This time it used its Edit tool instead of sed, and the log shows permissionMode default.

One more thing surprised me: ls and cat ran even though they were not on my list. That is documented. Claude Code treats a built-in set of commands such as ls, cat, head, tail, grep and wc as read-only and runs them without asking, in every mode.

The safe setup for an agent you run unattended is the default ask mode, an explicit list of allowed tools, and for anything riskier, a container. And check which mode it is really in, from its own output, before you trust the list.

Everything about what is new comes from Anthropic's changelog and GitHub releases, GitHub issue #91870, and Anthropic's docs pages, all read on 4 October 2026 and linked below. Release dates are the publish times GitHub gives, in UTC (5 hours 30 minutes behind India). The Hacker News score is from Hacker News's own API at the time I checked.

I did not install or write a mod. I ran Claude Code three times on one tiny task, so the times and costs are one small example, not a benchmark. The second and third runs cost $0.0790 and $0.2353 for the same fix, because the cache was already warm for the second, which shows how much one number can move.

The cost figures are Claude Code's own estimates at list price. I was signed in with a subscription, so no per-token bill was produced to compare them against.