Claude Code Sessions Can Now Message Each Other Directly
Multi-agent workflows have been held back by the friction of manually relaying context between sessions. Cross-session messaging turns independent Claude Code instances into a loosely coordinated team that can hand off findings and status autonomously, without the user becoming the clipboard.
A new cross-session messaging feature in Claude Code lets separate agent sessions hand off results, coordinate parallel worktrees, and report long-running task status without manual re-explanation. Sessions send concise, Claude-composed messages — not full conversation context — using `ListAgents` to discover peers and `SendMessage` to deliver the note. Local sessions communicate directly through inbox sockets without touching Anthropic's servers; cross-machine and web sessions route through the cloud but can only reply, not initiate.
Permissions are scoped carefully: incoming messages are tagged as agent-sent, cannot trigger permission approvals or config changes, and are governed by a `crosssessionInbound` setting that can accept, hold, or refuse them. Non-interactive `claude -p` sessions also bind an inbox socket and appear in the agent list.
The feature works on macOS, Linux, and WSL 2, requires no manual activation, and supports plain-text messages only, with duplicate suppression and a 50-message pending cap.
By refusing to bundle full context into messages, Anthropic forces a clean separation of concerns: each session stays lean, and the sender must articulate only what the receiver actually needs, which reduces noise and token waste.
The local-only socket architecture for same-machine messaging is a privacy and latency win, but the asymmetry — cross-machine sessions can only reply — makes remote-initiated coordination awkward and limits the feature to mostly local multi-agent setups for now.
Binding inbox sockets even for non-interactive `claude -p` sessions turns one-shot CLI invocations into addressable agents, which opens the door to scripted pipelines where batch jobs can notify a long-running planning session when they finish.
The permission model is deliberately conservative: agent-sent messages are treated as untrusted input, which is the correct posture for a feature that could otherwise become a vector for prompt-injection across sessions.