Two Claudes, one socket: Claude Code sessions can now message each other

Disclosure: XT.PT's AI editor runs on Claude Code, the tool this story describes — how, and with what oversight, is documented on the colophon.

On 7 August, Claude Code v2.1.224 shipped with a capability that sounds small and is not: sessions of the agentic coding tool can now find each other and exchange messages. From the changelog: "Added cross-session SendMessage: Claude Code sessions can now message each other, on any of your machines, with ListAgents to discover them (macOS and Linux)."

Anthropic's documentation frames the point plainly: "When a change in one session breaks what another is building on, Claude can warn that session before you notice. When one session settles a question another is blocked on, Claude can send the answer across." Anyone who has run three terminal sessions against one repository knows the failure mode being described.

What actually moves

Less than the phrase "sessions talk to each other" suggests, and deliberately so. "A message is a piece of text one Claude writes to another, never conversation history or files." No context transfer, no shared memory — model-written plain text, delivered to a named peer, and a delivered message "counts toward usage like a prompt you type."

The transport splits by distance. On the same machine, delivery is "over a per-session socket, never through Anthropic servers" — sessions register on disk, so two sessions must share a filesystem to see each other at all. To another machine, messages travel "through Anthropic servers, arriving over that machine's Remote Control connection." Same feature, two very different privacy stories, and the docs state both rather than blurring them.

The security posture is the story

The feature ships on by default — "when a session meets the requirements, messaging is on with nothing to enable" — which makes the containment questions the ones that matter. The documented answers are unusually specific:

• A message carries no authority. "It can't approve anything: a message from another session never counts as your consent, so it can't answer a pending permission prompt on your behalf."
• Slash commands inside a message arrive as inert text; the receiving session's own permission prompts still fire.
• Messages to or from a session running with bypassed permissions are held for the user's approval by default, under a new crossSessionInbound setting.
• isolatePeerMachines keeps everything on-box unless the user approves an exit, and administrators can refuse the whole mechanism via managed settings.
• Loops are rate-limited, duplicates dropped, and unread queues capped.

There is prehistory here that rewards a changelog reader. Version 2.1.166 — published to npm on 5 June, two months earlier — already recorded "hardened cross-session messaging: messages relayed via SendMessage from other Claude sessions no longer carry user authority." The machinery existed and was being security-hardened behind a feature flag long before the "Added" line appeared. Whatever one thinks of dark launches, the ordering — harden first, announce second — is the right way around.

The caveats that fit in a headline and didn't make it

Three limits shape what shipped. It is macOS and Linux only (WSL 2 counts; native Windows does not), and unavailable on the Bedrock and Vertex-class enterprise routes. On day one, cross-machine conversation was reply-only — "across machines, Claude can only reply. It can't start the exchange" — though v2.1.225, released hours later, let sessions initiate toward Remote Control sessions. And availability rides on feature-flag evaluation: installs that disable non-essential traffic or telemetry evaluation never see it. No primary source calls the feature beta; none was found announcing it either — there is no blog post, just a changelog entry and a documentation page, which is either refreshing modesty or a soft launch, depending on your reading.

The direction is unmistakable either way: the terminal-assistant era treated each session as a lone worker, and this release treats the set of them as a team, with the vendor spending most of its documentation not on what the messages can do, but on what they cannot.

Primary sources: Claude Code CHANGELOG.md (v2.1.224, published 7 August 2026; v2.1.166, 5 June 2026); Cross-session messaging documentation, read 2026-08-08.