Claude Code Sessions Can Now Talk to Each Other

Yesterday’s v2.1.223 closed out three straight days of permission and sandbox fixes. Today’s v2.1.224, shipped August 7, is a different kind of release — fewer bug fixes, more new capability, and every headline item points the same direction: running multiple Claude Code sessions as a coordinated fleet instead of one agent at a time.

Sessions Can Now Message Each Other

#

The standout addition is cross-session SendMessage, paired with ListAgents to discover what’s reachable. Per the changelog, a Claude Code session — running locally, on another one of your machines, or attached via Remote Control — can now send a message directly to another session and have it delivered into that session’s context, rather than the two only being able to coordinate through shared files, a human relay, or an external orchestration layer bolted on top.

That’s a meaningful primitive for anyone building multi-agent workflows on top of Claude Code rather than through a separate framework: a coordinator session can dispatch work to specialized sessions and get results routed straight back, on the same machine or across a fleet of self-hosted runners (more on that below), without inventing a message-passing scheme out of shared scratch files.

Anthropic paired the feature with a permission-aware safeguard worth calling out specifically, given how much of this week’s changelog activity has been about permission boundaries: two new settings, crossSessionInbound and dialogExpiry, control what happens when a message arrives. Messages sent to a session running with bypassed permissions are held for the recipient’s explicit approval rather than auto-delivered — a session that’s opted out of permission checks for its own tool calls doesn’t get to also silently accept instructions from another agent without a human in the loop. Messages to sessions running under normal permission rules auto-deliver. That’s the right default: bypassed-permissions mode already carries more risk per action, so cross-session messages landing in one of those sessions get an extra checkpoint instead of inheriting the same free pass.

Two related bug fixes in the same release matter for anyone actually relying on this: SendMessage previously could report “Message sent” even when the write to the recipient’s inbox had silently failed — that’s now surfaced as an error instead of a false positive, which is the difference between a coordinator agent noticing a dispatch failed immediately versus discovering it minutes later when a subagent never responds. The platform support is macOS and Linux for now, not Windows.

Self-Hosted Runners: Team and Enterprise Only

#

The other major addition is claude self-hosted-runner, which turns your own machines or containers into places where Claude Code web, mobile, and desktop sessions can actually execute — gated to Team and Enterprise plans. Combined with cross-session messaging, the shape of what Anthropic is building becomes clearer: a fleet of Claude Code sessions running on infrastructure you control, coordinating with each other directly, reachable from whatever client (web, mobile, desktop, CLI) is convenient at the moment. That’s a meaningfully different operating model than a single terminal session running one agent loop, and it’s the same direction this blog has tracked since Agent Teams landed earlier this year — mailbox-style coordination between multiple Claude instances, now getting first-class infrastructure instead of being something teams had to assemble themselves.

The Rest of v2.1.224

#

A few other changes worth flagging for teams running Claude Code day to day:

• archive plugin source. Plugins can now be installed from a zip hosted over plain HTTPS, with optional SHA-256 pinning, no git or npm required. That lowers the bar for internal plugin distribution — a team can host a signed zip on any static file server instead of standing up a git remote or npm registry entry just to share a plugin.
• The 200-subagent-per-session spawn cap is gone. Long-running sessions no longer hit a hard refusal once they’ve spawned 200 subagents over their lifetime — concurrency and depth limits still apply, but the lifetime ceiling that would eventually make a long agentic session start rejecting new work is removed. For workflow-heavy usage — the kind this blog’s own multi-agent pipeline patterns rely on — that cap was a real practical limit on session longevity.
• Sandbox credential-masking got more precise. New extract/onExtractNoMatch options handle structured environment values, decode: "jwt" with maskClaims adds JWT-aware masking so sandboxed commands can’t read token claims wholesale, and awsPairs/sigv4 support AWS SigV4 re-signing. These require network.tlsTerminate and are only honored from user, managed, or --settings-supplied configuration — not something a session can grant itself.
• A real fix for a subtle sandbox bypass: deny-list entries written with a trailing slash, like denyRead: "~/.aws/", were silently bypassable on Linux and macOS. That’s the kind of gap that looks correct in a config file and fails exactly when it matters — worth an audit of any denyRead/denyWrite rules your org has written with trailing slashes.
• Sandbox violations are now visible to the model. Previously, when a Bash command was blocked by a sandbox rule, Claude never actually saw why — the violation detail didn’t make it into the tool result. Now it does, which should mean fewer blind retries of the same denied command and more cases where the agent adapts its approach on the first block instead of the third.

Why This Release Reads Differently

#

Every fix in this week’s v2.1.221 through v2.1.223 run was about a boundary that looked intact but wasn’t — permission dialogs, sandbox deny rules, org policy. v2.1.224 is the first release in that stretch that’s mostly additive, and the additions aren’t random: self-hosted runners plus cross-session messaging plus an uncapped subagent lifetime is a coherent bet that the unit of work is shifting from “one agent, one session” to “a fleet of agents that can find and talk to each other.” That’s consistent with where this blog has argued Claude Code has been headed since Agent Teams — the interesting part isn’t any single feature in this changelog entry, it’s that the security hardening from the prior three days and the new coordination primitives shipped in the same week. A fleet of agents that can message each other is only a good idea if the permission boundaries between them actually hold, and this week shipped both halves back to back.

Source: Claude Code changelog, fetched directly, August 7, 2026.