Claude Code v2.1.224: Cross-Session Messaging, Auto Mode Default Change, and Everything Else That Shipped

• ListAgents — discovers which Claude Code sessions are reachable.
• SendMessage — delivers a plain-text summary to a named session.

The receiving session displays incoming messages as a labeled card with a link back to the sender, keeping context traceable . To see the roster of available sessions yourself, run /list-agents or /peers .

What Gets Shared (and What Doesn't)

Only plain-text summaries are transmitted. No conversation history, no file contents, no tool output is shared between sessions . When you tell Claude to hand off context to another session, it compresses the relevant state into a summary that the receiving session sees as a card with a link back to the sender .

Privacy and Routing

Same-machine messages travel over local Unix sockets and never touch Anthropic's servers. Cross-machine messages route through Anthropic's infrastructure when using Remote Control .

New Settings

Two new configuration options control approval behavior :

• crossSessionInbound — controls whether inbound cross-session messages are held for manual approval or auto-delivered.
• dialogExpiry — sets how long a pending approval dialog stays active.

Messages sent to a session running with bypassed permissions are held for your approval; messages to other sessions auto-deliver .

Platform Limitation

Cross-session messaging is available on macOS and Linux only (including WSL 2). Native Windows is not supported . The feature is also blocked on Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, and AWS .

Remote Control Enhancement

SendMessage can now start a conversation with Remote Control sessions on other machines by name — ListAgents shows them as

name [ref]

Self-Hosted Runner (

claude self-hosted-runner

)

Available as a public beta on Team and Enterprise plans only .

The

claude self-hosted-runner

Expanded Sandbox Credential-Masking Options

The sandbox credential-masking system received several new capabilities :

• extract and onExtractNoMatch — for structured env values, with a control for what happens when extraction produces no match.

• decode: "jwt"

  with maskClaims — JWT-aware masking that can decode and selectively mask JWT claims.
• awsPairs / sigv4 — AWS SigV4 re-signing support for the sandbox proxy.

These features require network.tlsTerminate and are honored only from user, managed, or --settings settings files .

Auto Mode Becomes Default (August 14, 2026)

Separate from the v2.1.224 release itself, Anthropic announced on August 7 that starting August 14, 2026, auto mode becomes the default permission mode for Pro, Max, and Team plan users .

What Changes

Instead of prompting for manual approval on every tool call, auto mode routes each action through a classifier that blocks only irreversible or destructive operations . Anthropic reports the classifier caught 89% of dangerous commands in their testing, compared to ~14% caught by human manual review .

What Stays the Same

• Users who prefer the old behavior can disable auto mode via the disableAutoMode setting .
• Users who have already pinned a different default mode will be asked before the switch .
• Enterprise, API, Bedrock, GCP Vertex, and Foundry accounts remain opt-in for now .

No Extra Token Cost

Anthropic announced it will no longer charge for the small number of extra tokens per tool call used by the auto mode classifier on Pro, Max, and Team plans .

Other Notable Changes in v2.1.224

• Archive plugin source: Install plugins from a zip over HTTPS without needing git or npm, with optional SHA-256 pinning .
• Cancel-and-confirm step when removing an unavailable paste changes a command's text .
• ANTHROPIC_BEDROCK_REGION_PREFIX env var for Bedrock to prefer a specific cross-region inference profile .

Key Bug Fixes

• Sandbox filesystem deny entries with trailing slashes (e.g.,

  denyRead: "~/.aws/"

  ) could be silently bypassed on Linux/macOS — now fixed.
• Sandbox violation details now appear in Bash tool results so Claude sees which file or network access was denied.
• Remote Control auto-start intermittently failing with "Remote credentials fetch failed" on cold start with a stale login token.
• Fixed long project paths (>200 chars) resolving to another project's session directory under a shared sanitized prefix.

What This Means for Developers

The v2.1.224 release represents a meaningful step toward autonomous multi-session coordination. Cross-session messaging lets developers working on different parts of the same project have their AI assistants share findings without manual context transfer . The self-hosted runner opens on-premise deployment for enterprise teams, and the credential-masking upgrades improve security for teams handling JWTs and AWS credentials.

The auto-mode default change on August 14 will likely be the most impactful shift for most users — it signals Anthropic's confidence that the classifier is safer and more efficient than manual approval. For teams that prefer human-in-the-loop control, the disableAutoMode setting preserves the old workflow.