Claude Code now fences nine policy variables off from the plugins you install

The outermost security layer built into Claude Code was rebuilt on October 11, and it now holds an organisation's environment variables and permission rules out of reach of the plugins its own people install. Anthropic's repository carries the change in a commit timestamped 19:07:16 UTC, pushed by the bot that publishes the mods folder.

The layer is a first-party mod named sec-default, seated outermost so every other plugin's decision passes through it. Anthropic's own description of it now names permission rules and the pinned environment among the things it keeps away from installed plugins, where before it named only tool policy and deny rules. The mod, Anthropic says, adds no policy of its own.

Pinned means a plugin from outside policy cannot set it. That covers every variable name an organisation puts in managed settings, plus CLAUDE_CODE_PROCESS_WRAPPER wherever policy names a launcher, plus nine names that Anthropic says are pinned on every build:

• CLAUDE_CODE_MANAGED_SETTINGS_PATH
• CLAUDE_CODE_REMOTE_SETTINGS_PATH
• CLAUDE_CODE_MOCK_REMOTE_SETTINGS
• CLAUDE_CODE_DISABLE_ADMIN_ENV_UNION
• CLAUDE_CONFIG_DIR
• CLAUDE_SECURESTORAGE_CONFIG_DIR
• USE_LOCAL_OAUTH
• USE_STAGING_OAUTH
• CLAUDE_LOCAL_OAUTH_API_BASE

All nine move where policy and sign-in are read from, or how policy's tiers compose. A plugin that reaches for one gets a refusal string that is new in this build: "env (managed): ${name} is not for plugins outside policy to change".

Two details decide the edges. With no policy to read at all, every variable counts as pinned, so the machine with no managed settings is the strictest case rather than the loosest. And matching is case-insensitive, for a reason the new code spells out in a comment: some systems read Path and PATH as one.

A plugin from a remote marketplace is never vouched for

A plugin pulled from a remote marketplace, whether git, GitHub or npm, is never treated as the organisation's own, whatever the organisation intended. Anthropic writes that such a plugin "can never be vouched for in this release", so it registers its tools among the plugins a person installs and is held at that tier with them. Only a copy read in place from a local folder marketplace that managed settings name is vouched for. Claude Code gained user-installable mods at the start of October, with Anthropic warning then that they can read your API key.

Anthropic names one gap in the hold itself. Where the engine's own check raises an ask that names neither a rule nor a hook, such as the read block's ask on a shell command or a dangerous removal's, the verdict does not tell it apart from the mode's own, so a person's plugin may still answer it.

The escape hatch narrowed too. Anthropic's allowModsToOverrideDenyRules setting does not unpin anything, and a policy flagged as writable by the person, such as the Windows HKCU hive, or a remote policy the server has not confirmed in this session, grants nothing from that setting. In Anthropic's wording, that policy still holds what it holds, and it grants nothing.

Six new hook events come with an admitted cost

The mod hooks six events it did not hook before. Two of them, env.get and env.set, are what make the pinning possible, and the other four are prompt.attachment, session.append, session.compact and ui.log. What counts as a plugin interfering widened at the same time: a plugin now interferes when it returns a more permissive decision, or the same decision under another reason, rule or hook. Tightening a decision is explicitly not a rewrite, and the warning a person sees gained a second verb, "tried to reword", for the case where the decision was kept and only its words or its rule changed.

Anthropic states the price of that as well. Hooking ui.log, env.get and env.set means each such call of any plugin's now runs a chain, and an env.set from outside the organisation's tiers waits on the policy read. Administrators got a list of permitted API providers in 2.1.285, and managed settings are where that list lives too.

None of this can be pinned to a version number you can check. The mod's manifest still reads 0.1.0 after the change, Anthropic publishes these files as they are built into the binary rather than as a separate release, and the newest published Claude Code is 2.1.296 from October 9, which predates the commit.

Note: Links to online stores in articles can be so-called affiliate links. If you buy through this link, MIXED receives a commission from the provider. For you the price does not change.