What changed
Anthropic released Claude Code 2.1.287 with Claude Mods for deeper plugin behavior changes and a built-in side-agent mod called You should know. The same release adds MCP URL prompts and many fixes spanning model policy, destructive shell safeguards, MCP permission ceilings, guardrail responses, remote control, cloud sessions and accessibility.
Why it matters
Mods widen what plugins can change inside the coding agent while the fixes close several authority and recovery failures. Teams need to treat 2.1.287 as both a new extension boundary and a security-sensitive regression checkpoint.
What to do
Pin 2.1.287 in a disposable repository. Inventory every enabled mod, deny a destructive shell write and an MCP tool above its organization ceiling, exercise Bedrock guardrails and model allowlists, then test remote reconnect, cloud recovery and plugin reload before wider adoption.
Caveat
The release is first-party evidence, not an independent security audit. The built-in side-agent mod requires first-party sessions with telemetry enabled, Mods can increase plugin authority, and the unusually broad fix set raises regression risk across providers and clients.