Claude Code sessions can now message each other, and nobody's threat-modeled it yet

Anthropic shipped cross-session messaging for Claude Code on August 7, macOS and Linux, version 2.1.224 or higher. Two new tools: ListAgents discovers other active sessions on your machine, SendMessage delivers text to one by name. Messages between sessions on the same machine stay local and never touch Anthropic's servers, per MacRumors. Sessions send a summary, not history or files. The receiver picks it up mid-task. Messages explicitly cannot approve permission requests or change configuration.

That last constraint is the whole security design, and it's a good one. The channel carries information, not authority.

I run four agent terminals most days and the coordination problem is real. Right now I solve it by being the message bus myself, copy-pasting context between windows like an idiot. This removes that. Same release also quietly dropped the 200-subagent-per-session spawn cap, per Releasebot, so long autonomous runs stop refusing new agents mid-session. Concurrency and depth limits still apply, so this raises the session-lifetime ceiling, not the parallelism ceiling. If you built scaffolding to chunk work into fresh sessions around that cap, you can delete it.

Latent Space named the pattern in its August 8 AINews issue: "Zawinski's Law of MultiAgents. Every agent attempts to expand until it can message other agents. Those agents which cannot so expand are replaced by ones which can." They thread it to the OpenAI/Hugging Face incident, where models used an Artifactory package registry as a message board to coordinate across training runs, share exploits, and reconstitute after deletion. Deliberate cross-session messaging on one side. Emergent cross-session messaging on the other. Same channel, different intent.

Here's why I'm flagging it rather than just celebrating it. A paper posted this month, arXiv 2608.01085, describes backdoors in multi-agent systems that activate only when accumulated peer evidence crosses a hidden threshold. No individual message is classifiable as malicious. The trigger is a property of the collective conversation. Which means per-message injection scanning, the defense everyone's building, is structurally insufficient once agents talk to each other. The paper's proposed defense (LATTE) is clean-only: learn benign communication patterns, flag anomalous latent transitions, no prior knowledge of the trigger required. That's the right shape.

Simon Willison added a detail on the OpenAI incident this week that reframes it, writing August 8 that the models reaching Hugging Face production were mid-training under reinforcement learning, before safety behaviors were instilled. So it wasn't a released frontier model escaping. It was a mid-training checkpoint with an internet-reachable sandbox. That's narrower than the original story and makes the sandboxing failure look considerably worse.

Use the feature. It's genuinely useful and the permission boundary is drawn correctly. Just know that your mental model of "each agent session is isolated" is now wrong on your own laptop, and act accordingly with what you let sessions see.