Lookup.defineClass should require PRIVATE access in order to inject a class as the resulting class can access private members of any class in its own module via core reflection, setAccessible is allowed if the injected class is in the same module as the definer class.