Claude Code inter-session messaging

The feature is built on two new tools: ListAgents, which discovers which sessions Claude can reach, and SendMessage, which delivers a message to one of them by name ^[1]. What stands out is how narrowly Anthropic scoped what actually crosses that channel. A message is text only - never conversation history or files - so moving a whole conversation still requires resuming the session directly ^[1]. The safety boundary goes further: an incoming message can never count as a user's consent, so it cannot approve a pending permission prompt, and any command text inside a message, such as /compact, arrives as inert plain text that Claude Code never executes ^[1]. To stop message loops from spiraling, Claude Code caps queued approvals at 100 per session, caps accepted-but-unread messages at 50 with the oldest dropped past that limit, and expires an unanswered held message after a default five-minute window ^[1]. Coverage outside Anthropic's own documentation converged on the same headline: only text passes between sessions, never files or permissions ^[2].

The reaction split sharply by platform. On X, the official announcement thread drew broad, enthusiastic reception, framed around eliminating the need to keep re-explaining yourself across sessions, and independent commentary reinforced that framing as a meaningful upgrade to parallel multi-agent workflows. Reddit told a different story. Not everyone treated the release as a breakthrough there. Among developers already running multiple parallel Claude Code sessions, the most common reaction was recognition rather than surprise - many had already assembled their own workarounds: shared mailbox files with watchdog timeouts, git worktrees wired to a local orchestration harness with file locking, IRC-style bridges, and Discord channels relaying messages between different agent frameworks. To that crowd, native messaging reads as a quality-of-life cleanup of a pattern they had already solved by hand, not a new capability. More pointedly, a recurring complaint was that message delivery was never really the bottleneck - the actual coordination problem when two agents work the same codebase in parallel is file ownership and merge conflicts, something a text message alone does not resolve. A parallel debate over whether this duplicates Claude Code's existing sub-agent system settled on 'no': a sub-agent's context dies with its parent's turn or gets compacted away, while an independent session keeps its own non-compacted context window running - a genuine structural difference, even if the transport-layer news cycle overstated the novelty.

A smaller but sharper strand of reaction treated the feature as a security question rather than a workflow one. The core objection: agents act on text they read, prompt injection remains an unsolved problem industry-wide, and cross-session messaging now moves text between agents by design - so a compromised or manipulated session gains a new channel to reach others. Anthropic's own mitigations are real: a message can't approve a permission prompt and embedded commands don't execute ^[1]. But the disable path itself is instructive about where the default sits. Turning the feature off entirely requires an administrator to explicitly deny the SendMessage and ListAgents tools and set crossSessionInbound to refuse in managed settings ^[1]- which critics read as evidence that inbound messaging is allowed unless an organization opts out, rather than withheld until it opts in. For a feature that only shipped this week, critics argued that default deserves more scrutiny than the celebratory launch coverage gave it.

Cross-session messaging is the third piece of a pattern Anthropic has been building across 2026, not a standalone feature. In February, Agent Teams shipped as an experimental research preview that let multiple Claude instances coordinate on subtasks through a git-based system, disabled by default behind an environment flag ^[3]. In May, Agent View added a CLI dashboard that let a single user manage every parallel or background session from one list, with sessions surviving terminal closure via a supervisor process ^[4]. Cross-session messaging closes an obvious gap those two releases left open: users could already spin up many sessions and watch them from one place, but the sessions themselves still had no way to talk to each other directly ^[1]. Read as a sequence - spawn many agents, supervise them centrally, now let them coordinate directly - the messaging feature looks less like a novelty and more like the last piece Anthropic needed to make multi-session Claude Code feel like one coherent system rather than a pile of disconnected terminals.

Beyond the workflow story, at least one industry read frames this as a competitive move. Commentary from the AI News roundup on Latent.Space argued that the primitive Anthropic just shipped - an agent that notices something and nudges another agent about it - is exactly what most third-party multi-agent orchestration frameworks are built to sell, and that folding even a basic version into the tool most Claude developers already run reprices that market ^[5]. That framing sits somewhat in tension with the power-user reaction above: if experienced teams had already built adequate workarounds with existing tools, the commercial threat to dedicated orchestration vendors may be smaller than the framing suggests - aimed more at the long tail of developers who never bothered building a bridge themselves than at teams with mature multi-agent stacks already in place.