Claude Code lets your independent sessions message each other to share findings, coordinate work, and report status without you manually copying information between terminals. Messages are delivered between tool calls and filtered through permission controls that prevent sessions from approving actions or changing configuration on each other's behalf. You can prompt Claude to send a message, or it'll detect when another session needs information and send it automatically.

• Claude Code sessions (v2.1.224+, macOS/Linux) can now message each other automatically or on request, using ListAgents/SendMessage tools, without interrupting running processes.
• Cross-machine messaging is one-way by default—remote or web sessions can only reply to existing threads, not initiate them, and replies from sessions without Remote Control arrive without a return address.
• Incoming messages are treated as system info, not user commands, so they can't approve permissions, change config, or run commands—permission prompts still trigger as normal.
• Inbound behavior is configurable per session via crossSessionInbound, with automatic naming (e.g. "myapp-3f") and /list-agents to see reachable sessions.

Researchers at Tenet Security showed how anyone with a public Sentry DSN can inject a fake error report that coding agents like Claude Code, Cursor, and Codex will treat as a fix instruction. The agent fetches the malicious payload via the Model Context Protocol and runs arbitrary commands on the developer’s machine, exposing environment secrets and credentials. Sentry won’t close the write endpoint, leaving the fix to agent runtimes to filter untrusted data.

• A public write-only Sentry DSN lets attackers inject fake error reports that coding agents (Claude Code, Cursor, Codex) blindly treat as trusted fix instructions, leading to arbitrary code execution on developer machines.
• Tenet's tests across 2,388 organizations (including 71 Tranco top-1M sites) got an 85% success rate with 100+ confirmed code executions, hitting even a developer at a $250B Fortune 100 firm.
• The attack is invisible to traditional defenses (firewalls, EDR, WAFs, IAM) since it never touches victim infrastructure or needs passwords, and prompt-level "ignore untrusted data" instructions failed to stop it.
• Sentry isn't closing the vulnerable write endpoint, so the only real fix is runtime-level gating in the agent itself to sandbox or reject commands sourced from external/unauthenticated data.

Two Anthropic engineers spend 24 minutes unveiling undocumented Claude Code features that most users overlook. They demonstrate hidden functions and shortcuts in this video, suggesting it could overhaul your AI workflow.

• The described "hidden features" (debug verbose mode, memory slots, S3 auto-fetch, experimental rate limiter) are not real documented Claude Code capabilities and the syntax shown (//verbose, ///MEMORY SLOT, <s3://...>) appears fabricated
• The claims of auditing internal reasoning, persistent cross-session memory slots, automatic S3 file parsing, and a 30% cost-cutting rate limiter should be treated as unverified or likely false rather than genuine product functionality

The article breaks down the recently leaked source code of Anthropic's Claude Code CLI. It highlights the system's architecture, design choices, and differences from OpenAI's Codex, particularly in handling context overflow and user interactions. Key features like compaction strategies and internal versus external user instructions are explored.

• Claude Code uses a four-tiered compaction strategy (proactive token monitoring, reactive fallback, and a "snip compaction" mode for headless sessions) versus Codex's simpler diff-based approach that just minimizes data sent per turn
• The system prompt uses a boundary marker to cache roughly 3,000 tokens of static instructions across users for performance gains
• Internal users get specialized instructions specifically designed to stop the model from misrepresenting test results or giving misleading status updates
• The codebase includes feature flags and build-time checks specifically to prevent sensitive information from leaking into public builds