Claude Code Sessions Can Now Message Each Other. Here's What Decides If It Gets Through.

What happened

Claude Code can now let one of your sessions send a message straight to another one, according to Anthropic’s documentation. The feature, called cross-session messaging, requires Claude Code version 2.1.224 or later and only runs on macOS and Linux, not Windows. Where it’s available, it’s on automatically. There’s nothing to turn on.

This helps if you run more than one Claude Code session at a time. That might mean working in separate worktrees, isolated copies of the same repository that let you work on multiple branches side by side, or watching a long migration run in another terminal. Either way, it replaces some of the copy-pasting between windows. Claude can now tell another one of your sessions that a schema changed, that a migration finished, or that it’s safe to rebase.

Two tools make this work: ListAgents, which finds which of your sessions Claude can reach, and SendMessage, which delivers text to one of them by name. A message is only text. It never carries the sending session’s full conversation history or files, and it can’t run commands. If a message contains something that looks like an instruction, such as /compact, Claude Code treats it as plain text rather than executing it.

Every incoming message lands in one of three states: delivered straight to the receiving Claude, held until you approve it, or refused and dropped without ever reaching Claude.

Why it matters

The interesting part is what decides whether a message gets delivered automatically or held for your approval, and it connects directly to yesterday’s change, where auto mode becomes Claude Code’s default permission setting on August 14. Auto mode replaces the usual “approve this command?” prompts with a built-in checker that clears routine actions on its own and only interrupts you for anything it isn’t confident about.

When you haven’t set a rule yourself, Claude Code sorts each session into one of two groups. Sessions that skip permission prompts entirely, meaning nothing about their work gets checked with you at all, count as “bypassing.” Everything else, including auto mode, counts as “prompting,” since those sessions still stop and ask you about anything the checker isn’t sure of. A message between two “prompting” sessions is delivered immediately, without an approval dialog. One arriving at a “bypassing” session gets held for your approval instead, unless the sender is also bypassing.

Auto mode falls into the “prompting” group, and it becomes the default for most people on August 14. That means most sessions will start passing messages to each other automatically, with no popup to click through. It’s the same tradeoff auto mode already makes for individual commands, now extended to messages between your own sessions.

This is narrower than it might sound. A message from another session can never approve a permission prompt on your behalf, and Claude Code explicitly instructs the receiving session never to change settings or your CLAUDE.md project instructions because another session asked. Whatever the message asks the receiving session to do still has to clear that session’s own permission rules, the same way any other request would. A compromised session can’t use messaging to hand another session blanket access it didn’t already have.

What it can do is put misleading text in front of a session that would otherwise trust its own judgment. Say one of your sessions reads a webpage or file with hidden instructions planted by an attacker, a trick known as prompt injection, and gets fooled into believing them. It could now pass that bad framing along to a second session automatically, with no approval screen in between. The second session still needs its own permissions to act on it, but a well-worded message could talk it into using access it already has in a way you didn’t intend.

Who should care

This affects anyone running multiple Claude Code sessions on macOS or Linux at once, whether that’s parallel worktrees, a background migration you’re watching from another terminal, or background agents. It doesn’t apply to Windows, and it isn’t available yet on Amazon Bedrock, Claude Platform on AWS, Google Cloud’s Agent Platform, or Microsoft Foundry.

It matters most for anyone who plans to keep running auto mode after August 14, since that’s the setting that makes messages between sessions arrive without a prompt.

What builders should do next

Run /status in a Claude Code session to check whether it has a “Peer address” row. If it does, the session can send and receive messages. Run /list-agents (also available as /peers) to see which of your other sessions it can currently reach.

If you’d rather approve every incoming message by hand instead of accepting the automatic default, set crossSessionInbound to hold in your Claude Code settings. Setting it to refuse turns off incoming messages entirely. If you only want to require approval before a message can leave your machine to reach a session running somewhere else, set isolatePeerMachines to true instead.

None of this closes the door on prompt injection reaching a second session through a message. It just means the choice between convenience and a manual check now sits in a setting you control, rather than a default you might not know is there.

End of article