Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-10 · high
Inbound messages can't approve permissions, edit CLAUDE.md, or run slash commands, per the docs.
Why now: It reached Hacker News' front page at 160 points on Aug 10, pulling engineers into a close read of the security model.
Claude Code sessions can now message each other through a per-session Unix socket, starting in version 2.1.224, per Anthropic's documentation.
That capability reached Hacker News' front page at 160 points. The scrutiny makes sense: engineers running several Claude Code sessions in parallel need messages that can't hijack another session's permissions or files.
The docs draw that line explicitly. Inbound messages can never approve a permission prompt, edit CLAUDE.md or settings, or run a slash command, no matter what the sender writes.
The feature ships for macOS and Linux, not for Bedrock, Vertex, or Foundry.
Each session binds an inbox socket scoped to your OS user. Hooks read it through the CLAUDE_CODE_MESSAGING_SOCKET variable, and /status shows it as Peer address.
A crossSessionInbound setting decides how a session handles what arrives: accept, hold, or refuse. Anthropic capped the read queue at 50 messages and the hold queue at 100, so two sessions can't spin each other into a loop.
The real test is a bypass report: a message that changes a receiving session's behavior without that session choosing to accept it. That would break the boundary the whole feature depends on.
Each link below shares sources, entities, or timing with this story.
Claude Code supports Bedrock / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Claude Code supports Bedrock); both cover Bedrock, Claude Code, Foundry, Vertex; reported by the same outlet (code.claude.com).
Linked by a graph relationship (Claude Code supports Bedrock); both cover Bedrock, Claude Code, Foundry, Vertex; reported by the same outlet (code.claude.com).
Claude Code released SendMessage / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code released SendMessage); both cover Claude Code, Linux; reported by the same outlet (code.claude.com).
Claude Code released Agent Teams / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code released Agent Teams); both cover Claude, Claude Code, Each; overlapping topics (claude, each, session).
Claude Code supports Bedrock / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code supports Bedrock); both cover Bedrock, Claude Code; reported by the same outlet (code.claude.com).
Claude Code uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover Bedrock, Claude Code, Cross; overlapping topics (bedrock, claude).
Claude Code supports Bedrock / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Claude Code supports Bedrock); both cover Bedrock, CLAUDE, Claude Code; reported by the same outlet (code.claude.com).
Stripe uses Claude Code / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Stripe uses Claude Code); both cover CLAUDE, Claude Code, Each; overlapping topics (claude, each).