Claude Mods are TypeScript or JavaScript plugins that hook into Claude Code's events, letting you control when the agent interrupts you and what it shows you. The author compares this approach with ChatGPT's Intelligent UI and Cursor's PR Routing, arguing that Mods let the user design the interface rather than accept one a company built.

• Mods are middleware that intercept prompts, tool calls, and renders, so you can change how Claude Code behaves and displays information at runtime.
• The built-in You Should Know mod caught uncommitted work in 45 files that a demo edit would have discarded, showing how a side agent can flag what the main agent buries.
• The author's Next Steps Supervisor fired on 99 of 111 turns, so the noise and token cost (roughly 5–6k tokens per check) undercut its value, and mods are unsandboxed code running with your permissions.

Researchers at Tenet Security showed how anyone with a public Sentry DSN can inject a fake error report that coding agents like Claude Code, Cursor, and Codex will treat as a fix instruction. The agent fetches the malicious payload via the Model Context Protocol and runs arbitrary commands on the developer’s machine, exposing environment secrets and credentials. Sentry won’t close the write endpoint, leaving the fix to agent runtimes to filter untrusted data.

• A public write-only Sentry DSN lets attackers inject fake error reports that coding agents (Claude Code, Cursor, Codex) blindly treat as trusted fix instructions, leading to arbitrary code execution on developer machines.
• Tenet's tests across 2,388 organizations (including 71 Tranco top-1M sites) got an 85% success rate with 100+ confirmed code executions, hitting even a developer at a $250B Fortune 100 firm.
• The attack is invisible to traditional defenses (firewalls, EDR, WAFs, IAM) since it never touches victim infrastructure or needs passwords, and prompt-level "ignore untrusted data" instructions failed to stop it.
• Sentry isn't closing the vulnerable write endpoint, so the only real fix is runtime-level gating in the agent itself to sandbox or reject commands sourced from external/unauthenticated data.