Claude Code 2.1.224: sessions can now talk to each other, a real sandbox bypass closed

Claude Code 2.1.224 shipped on August 7. A real sandbox bypass gets closed, your sessions can now message each other across machines, and the feedback transcript share now carries more than it used to. Here’s what matters.

Security: a sandbox rule that could be silently bypassed, fixed

If you use denyRead or denyWrite with a path ending in a slash, like denyRead: "~/.aws/", that rule could be silently bypassed on Linux and macOS. The sandbox thought it was blocking access; it wasn’t always doing so. If you’re relying on these rules to protect credentials or keys, make sure you’re on 2.1.224.

Two related, quieter fixes worth knowing about:

• When a Bash command trips a sandbox violation, Claude now sees which file or network access was denied and why, instead of nothing at all. That’s a real change to debugging an overly strict sandbox: before, you had to guess.
• Sandbox credential masking gains options for structured values (extract, onExtractNoMatch), JWT-aware decoding (decode: "jwt" with maskClaims), and AWS SigV4 re-signing (awsPairs/sigv4). These require network.tlsTerminate and are only honored from user, managed, or --settings-supplied settings.

Claude Code sessions can now message each other

The headline feature: SendMessage lets Claude Code sessions send messages to each other, including across machines (macOS and Linux), and ListAgents discovers which sessions are reachable. If you run several sessions in parallel on related work, this is the kind of primitive that changes how you coordinate them.

Two guardrails ship alongside it:

• crossSessionInbound and dialogExpiry: a message sent to a session running with bypassed permissions is now held pending your approval instead of delivered straight through. Messages to other sessions still auto-deliver.
• SendMessage used to report “Message sent” even when the write to the recipient’s inbox had actually failed. That’s fixed: a failed delivery now surfaces as an error.

A related addition for Team and Enterprise plans: claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can run.

What changes your day-to-day

• Feedback transcript share: with your consent, it now also uploads the last request’s model settings, the system prompt (which includes your CLAUDE.md instructions), tool definitions, and model parameters. Secrets are still redacted as before, and these fields are the first to get dropped if the share is too large. If you share transcripts from a sensitive project, know that it now carries more than the conversation text.
• 200-subagent-per-session cap: removed. A long-running session no longer refuses new agents for that reason (concurrency and depth limits still apply).
• Bash tool description: it now consistently notes that command output is shown to the model, not reliably to the user.
• Managed settings: the approval prompt no longer re-appears after a re-login or org switch when the org’s settings haven’t actually changed.
• Plugin installs: a new archive source installs a plugin from a zip served over HTTPS, no git or npm required, with optional SHA-256 pinning.
• Bedrock: ANTHROPIC_BEDROCK_REGION_PREFIX lets you prefer a specific cross-region inference profile over the one auto-derived from AWS_REGION.

The rest, worth a skim

• Long project paths (over 200 characters) that could resolve to another project’s session directory through a shared, truncated sanitized prefix: fixed. Session list, rename, fork, delete, and /resume no longer cross projects.
• Plugin install records silently corrupted when the same plugin was installed in multiple projects: fixed.
• Recalled or restored paste content occasionally attaching the wrong data or silently losing text: fixed.
• Copy-on-select on Wayland sometimes not reaching the clipboard because of a race between two writes: fixed.
• Fullscreen mode now keeps the full pre-compaction history in scrollback across repeated compactions, instead of only the most recent interval.
• Remote Control: several fixes (intermittent cold-start failures, blank “(no content)” messages after /clear, a recreated session unintentionally uploading local conversation history, a persistent disconnect indicator instead of an 8-second toast, compaction progress now visible to attached clients).
• VS Code: the extension used to show Remote Control as connected even after the connection failed, now fixed; an explicitly enabled remoteControlAtStartup is now honored on resume.

Should you update

Yes, especially if you rely on denyRead/denyWrite with trailing-slash paths to protect sensitive data: that was a false sense of security. And if you share transcripts for feedback, check what that now includes before doing it on a confidential project.

Source: official Claude Code changelog.