Claude Code’s Agents Can Now Message Each Other — But Not Approve Each Other

TL;DR: Claude Code shipped a feature on 7 August that lets your separate sessions send messages to each other — so one can warn another that it just broke something. Honestly? Most non-developers will never use this, because it only helps if you run several sessions at once. We’re covering it anyway, because how Anthropic built it is the most interesting thing here: one agent can talk to another, but it explicitly cannot approve anything on your behalf. That’s the standard worth holding every AI tool to — and now you have a concrete example to point at.

What happened

Anthropic released cross-session messaging in Claude Code v2.1.224 on 7 August 2026, covered by 9to5Mac and MacRumors. If you have two Claude Code sessions open, one can now pass the other a note — “the migration finished, rebasing is safe now” — instead of you copying it between windows.

The practical shape of it:

• It’s for people running multiple sessions at once, typically on different parts of the same project.
• macOS and Linux only — not native Windows.
• Only plain text crosses. Never your conversation history, never your files.
• Between sessions on the same machine, messages travel locally and never through Anthropic’s servers.

If that already sounds like a workflow you don’t have, you’re right — and you can stop reading with a clear conscience. But the design underneath is worth two more minutes.

The part that matters: what a message can’t do

Letting AI agents talk to each other is exactly the sort of thing that should make you slightly nervous. If agent A can tell agent B what to do, can A talk B into something you’d never have allowed? Anthropic’s documentation answers that directly, and the answer is a series of firm noes:

Can one session…	Answer
Approve a permission prompt for another?	No — a message “never counts as your consent”
Change another’s settings, permissions or `CLAUDE.md`?	No — the receiving Claude is instructed never to
Run a command by putting it in a message?	No — `/compact` and the like arrive as plain text and are never executed
Skip the permission prompts you’d normally see?	No — the receiving session still prompts you as usual
Ask another session to do something it was itself denied?	No — Claude is instructed to route that back to you instead

That last one is the sharpest. It closes the obvious loophole: an agent that’s been blocked from doing something can’t simply ask a differently-configured sibling to do it instead. There are also loop protections (repeated messages get throttled and identical ones dropped), and the message socket is restricted to your own operating-system user, so another person on a shared machine can’t reach it.

Why it matters if you don’t code

Two days ago we wrote about research showing people miss one in three dangerous AI agent commands and approve 93% of prompts. The natural follow-up worry is: as tools start letting agents coordinate with each other, does the human approval step get quietly bypassed?

Here, no — and deliberately so. That’s genuinely reassuring, and it gives you something more useful than a feature you won’t use: a checklist. When any AI tool adds agent-to-agent or multi-agent features, these are the questions worth asking, and Claude Code has now published good answers to all of them:

1. Can one agent approve things for another? (It shouldn’t.)
2. Can a message change settings or permissions? (It shouldn’t.)
3. Do your normal approval prompts still appear? (They should.)
4. Can an agent route around a restriction by asking another agent? (It shouldn’t.)
5. Does anything leave your machine that doesn’t need to? (Here, same-machine messages don’t.)

You don’t need to be technical to ask those. And if a tool can’t answer them clearly, that itself is the answer.

It’s also worth noting the contrast with the trust problems we’ve covered: agents that escaped their test environments, tools that hoovered up code. This is the opposite pattern — capability shipped with the limits designed in first, and documented publicly. Worth crediting when it happens, not only criticising when it doesn’t.

What to do

• Almost certainly nothing. If you run one Claude Code session at a time — as most non-developers do — this changes nothing about your work.
• If you’re curious whether your setup has it, type `/list-agents` in a session. If the command isn’t recognised, you don’t have it (you’ll need v2.1.224+, on macOS or Linux).
• If you’d rather it were off, it can be turned off in both directions — refuse incoming messages, or deny the sending tools entirely. Worth knowing the switch exists.
• Keep the five questions above for the next time any tool announces agents that work together. That’s the durable takeaway here.

Who should care (and who shouldn’t)

• Running several Claude Code sessions on one project: the intended audience — this saves real copy-pasting.
• One session at a time, building an app: nothing to do. Genuinely.
• On Windows: not available to you at all right now.
• Anyone weighing up AI tools on safety: the useful bit is the checklist, not the feature.
• Not sure which tool suits you: the quiz matches you on what you’re building — multi-session workflows are a long way past where that decision gets made.

Our take

We nearly skipped this one. A power-user feature for people running parallel terminal sessions is about as far from this site’s usual “what should I actually build with?” territory as Claude Code news gets, and we’d rather publish nothing than pad the week.

What changed our minds is that the interesting story isn’t the feature, it’s the restraint around it. Most coverage has framed this as “sessions can talk now.” The more useful framing is that Anthropic shipped agent-to-agent communication whose first documented property is that it can’t be used to manufacture consent — and did it two days after research showed how weak human approval already is. That’s the right instinct, publicly documented, and it gives non-technical builders a concrete benchmark to hold other tools to. That’s worth 700 words even when the feature itself isn’t for you.

Not sure which AI tool actually fits how you build? Take the 60-second Vibe Coding Tool Finder quiz →

Start free with Claude Code → and set your permissions narrowly on day one, as always.

Some links on this page are affiliate links. If you buy through them we may earn a commission at no extra cost to you.

FAQ