Your Claude Sessions Can Message Each Other. None of It Counts as Consent.

Claude Code 2.1.224 let your sessions message each other, and 2.1.232 added @session-name so you can address one by hand. Useful. But the line that matters is a constraint, not a capability: a message from another session never counts as your consent.

Read the rest of that list. An incoming message can't answer a pending permission prompt. It can't change permission settings or CLAUDE.md, no matter how convincingly it asks. A /compact in the text arrives as plain text and never executes. And the sending Claude is instructed never to ask another session for an action its own permissions blocked — that work routes back to you instead.

That's a privilege-escalation model written down before anyone shipped the exploit. The channel is throttled to match: identical repeats inside a short window get dropped, unread accepted messages cap at 50 per session, held messages cap at 100, and an unanswered approval dialog expires in five minutes. Two sessions on one machine talk over a per-session socket that never reaches Anthropic's servers. A message loop between two agents stops on its own.

The lesson generalizes past Claude Code. The moment your agents can talk to each other, who asked for this becomes a security question. Most in-house multi-agent setups pass messages on a queue with no sender identity and no permission class — which means agent A can ask agent B for precisely what A was denied.

See how we close it →