Anthropic now lets Claude Code sessions communicate directly with each other: since version 2.1.224, a session on macOS or Linux automatically informs another one as soon as a change affects its task. The exchange never includes the full conversation history or file access, only a short text message sent through the new tools ListAgents and SendMessage.
Two tools handle discovery and delivery
Claude finds the right counterpart on its own: the ListAgents tool lists all reachable sessions by name, and SendMessage then delivers the text to the chosen session. Users never call either tool manually – a simple prompt like “tell the session in my other terminal that the migration finished” is enough, and Claude writes the rest itself.
If the other session runs on the same machine, delivery happens over a local socket, bypassing Anthropic’s servers entirely. If the other session runs on a second computer or in the browser via Claude Code on the web, the current session can only reply, not start a new exchange; that message then travels through Anthropic’s infrastructure and the target device’s Remote Control connection.
The feature targets parallel work on the same project: one session can tell a second that a database field was renamed, or a long-running test suite can send a status update on its own once it finishes. As OpenAI shows in its Codex command-line tool, communication between AI sessions is no longer an isolated case – there, the company additionally encrypts messages between agents, while Claude Code relies on plaintext paired with strict permission boundaries.
Permissions stay tied to each individual session
An incoming message never counts as the user’s consent. According to Anthropic, it cannot approve an open permission request or change settings, the CLAUDE.md file, or any other configuration. Commands such as /compact that appear in a message’s text are not executed by Claude Code; they show up as plain text instead. If the message calls for an action the receiving session isn’t yet cleared for, the usual permission prompt appears just as it would for any other instruction.
How a session treats incoming messages can be set via the crossSessionInbound setting to “accept,” “hold,” or “refuse”; without a custom setting, Claude Code decides based on both sessions’ permission modes. Held messages need individual approval before delivery and expire automatically after five minutes. If a message loop between two sessions repeats too fast, Claude Code throttles the exchange on its own to prevent endless loops.
The feature works only with Claude Code version 2.1.224 or later on macOS and Linux – it is unavailable on Windows and with the provider integrations Amazon Bedrock, Google Cloud, and Microsoft Foundry, regardless of version. Organizations can also disable message exchange entirely through centrally managed settings.
What will matter is whether companies fold the feature into their security policies for AI tools before development teams adopt it day to day. Unlike Claude’s voice mode for Gmail, Calendar, and Slack, a session here never reaches into outside tools – it only reaches other instances of the same program on the same machine or through its own Remote Control link, which keeps the exposure comparatively narrow. It remains open whether Anthropic will extend messaging to Windows or to the cloud-provider variants it currently excludes.
