Claude Code Sessions Can Message Each Other

Claude Code sessions can now message each other through a per-session Unix socket, starting in version 2.1.224, per Anthropic's documentation.

That capability reached Hacker News' front page at 160 points. The scrutiny makes sense: engineers running several Claude Code sessions in parallel need messages that can't hijack another session's permissions or files.

The docs draw that line explicitly. Inbound messages can never approve a permission prompt, edit CLAUDE.md or settings, or run a slash command, no matter what the sender writes.

The feature ships for macOS and Linux, not for Bedrock, Vertex, or Foundry.

Each session binds an inbox socket scoped to your OS user. Hooks read it through the CLAUDE_CODE_MESSAGING_SOCKET variable, and /status shows it as Peer address.

A crossSessionInbound setting decides how a session handles what arrives: accept, hold, or refuse. Anthropic capped the read queue at 50 messages and the hold queue at 100, so two sessions can't spin each other into a loop.

The real test is a bypass report: a message that changes a receiving session's behavior without that session choosing to accept it. That would break the boundary the whole feature depends on.