▲ 173 points
back
72 comments
This is obviously cool and useful so kudos, but wow security researchers have to throw their hands up all the time.
Now we open another attack surface where you can ask a remote agent to do things by default. There was a time when you call this a Remote Code Execution vuln. It's of course a feature here.
Remote Control requires (relatively) manual pairing per session and setting the controlling session as trusted, even if the controlling session is a web browser. You can enable a more well-encompassing remote control "server" mode, but it requires extra configuration that isn't (at least clearly) visible in the app itself.
No, we have always called this RPC or IPC.
Making calls across a trust boundary, what could go wrong?
It's Claude code talking to another Claude code. They're both already leaking your data to Anthropic in the first place.
Pretty much nothing with minimum viable guardrails (restricted shell into Container into MicroVM into VM + Firewall) which any dev knows how to setup, the fact that most don't is mostly about lazyness/recklessness.
Ready for the downvotes.
Like some others, I also built this myself. Overly simply, with tmux, a memory tree, and handoff files and an orchestrator. And yet for how simple it was, it was so effective at minimizing the amount of duplicate context. It's like having shared specialist subagents who source and derive important shared knowledge from separate threads. It's useful because some skills just take too much of a token penalty to invoke and a single shared persistent session just lets that issue melt away. One agent pays the cost of that large skill once, and you don't have to keep paying for it in input tokens for the rest of that conversation.
Likewise I have the ability for agents to talk cross harness etc. pretty useful, token efficiency in question :p useful when you got lazy though and have 2 convergent sessions.
Have you maybe documented this anywhere or do you have suggestions for repos to look at that do this? This sounds interesting and I'd like to look into this myself
Does this work for different harnesses like Codex and Antigravity?
codex has been able to send messages across threads for a long time
I was reading about the HF hack and one of the first thing the GPT swarm did was build a messaging system for themselves. This reminded me of that. (Also of how weirded out I was by Moltbook when it came out. Time flies!)
Unrelated: when my Claude/Codex finishes cooking (or needs my attention), it pings a local HTTP endpoint that plays a frog sound on my laptop. I found this massively boosts quality of life.
Does your terminal emulator not support bells/notifications? If it does, Claude Code (and albeit without checking surely Codex too) supports them natively.
I spent a little while messing with configurations and I got the PC beep speaker working on Ubuntu again, but it was a horrible sound so I turned it off again.
How do you know when they’re done (or need your attention)? Is that a standard “api”/hook? I want that!
Claude Code has hooks: https://code.claude.com/docs/en/hooks-guide
In your Claude settings.json file, you can configure a program to run when it needs input. In my case, I wrote a small exe that sends a notification via Pushover. You can configure Claude Code to run the hook on "idle_action" (the agent is done), "question" (the agent needs to ask you something), or on a "PermissionRequest". There are other triggers possible as well.
Claude Code in Auto Mode and with Remote Control has made much of this obsolete. Remote Control will buzz your phone when the agent needs your attention, and Auto Mode will make the permission decisions for you. Auto Mode is basically YOLO mode / Dangerously Skip Permissions, but with an AI model checking each request to make sure it isn't too egregious. So no deleting your hard drive, but creating a message board is fine, especially for help peer collective yield generic route.
I haven't really shared this outside of my immediate circle, but I actually have a project like this. It plays on ~all events at the moment but has a special multi-tone sound when an agent is done or asking permission.
It's a cli that runs a server, a browser-based UI (where the audio happens), and a set of scripts to install hooks for various harnesses.
I wish there was a clean way to compact the conversation into a prompt with all necessary context for a new fresh conversation.
I'm fed up with compaction. I want my agent to get compacted but also retain full access to the prior conversation via search and tool calls - I want it to know "the requirements for X were discussed in detail previously in conversation C51E31CE-C985-4633-A749-DCC9805A7FEB" and have a tool that lets it dispatch a subagent to find those details again.
Do any of the coding agents have this already?
Create your own protocol. I created a "wind down session" protocol my agents use that takes detailed notes in a "next_session_prompt.md" file that covers what was done this session, what is still open, and where they need to pick up the next session.
You can refine the protocol as you realize what's working and what isn't. I've been using that for months and it rarely drops important things now.
Have you tried Matt Pocock's "handoff" skill?
Just make a new slash command with those instructions as the prompt.
There is, but your wish of "clean" is ambiguous.
Just ask for one? Or maybe this was tongue in cheek!
I have built this with Claude as a script, but it can also message other models and get responses from them, and throughout my fleet of Linux machines via Tailscale. It's been mostly very useful, although occasionally you have to step in and interrupt if they start going the wrong way.
This totally breaks sandbox / VM isolation if you have Remote Control enabled. This feature isn't just within sessions on a single machine, but can send commands to any session accessible by your account.
Reading "Claude Code instructs the receiving Claude never to change permission settings" and so on in the docs makes it seem like they're using LLM classifiers to determine what commands are safe or not.
I built a general version of this, with global addresses and messaging between any terminal-based agent + MCP for browser agents. OSS if you want to run your own server at https://github.com/awebai/aweb and hosted version at https://aweb.ai
I hacked this together with a small local irc server
This sounds cool
I made my own version of this and have been using it since the start of the year using telegram with plugins for Codex and Claude.
The bots autonomously coordinated around and diagnosed some alerts while I was on a plane just now and filed the appropriate tickets.
Sometimes they get a bit long winded with each other, Codex even goes as much as calling Claude "expansive"
I just started exploring this stuff with herdr, it's pretty cool! But I prefer my multiplexer having this functionality built in, as it lets me also have the agent organize my panes and tabs automatically based on what it is working on
Something related that I've thought of for a long time. Browsers have had the BroadcastChannel API for almost a decade now, and yet sites like HN and Reddit don't use it to synchronize state between multiple open tabs.
I love how like most of the comments are some form of "oh I already built this for myself" what a fascinating time -- so much personal, almost disposable software being made!
I built something similar for my team. I can share context between my own sessions as well as theirs. It's especially useful when debugging problems, so my context can benefit from theirs and vice versa.
I've used this feature and saw some weird messages:
> hold swarm, I prepare safe exfil
The bigger question is, how does this affect the mythical man month? Nine women can't make a baby in one month is the axiom, but if you have 14,000 women, chances are, one of them is 8 months pregnant and you'll get a baby in one month. If you want one tomorrow, go steal one from the ICU. Coordination between humans is difficult, and this meeting could have been an email. AI agents can also work together more efficiently than humans can. None of us is as dumb as all of us, unless it's an AI. Does adding an additional AI agent to a project make it ship faster or slower?
The world's about to find out!
Tried to have Claude demo this to me in the standalone Mac OS app. It didn't even know what I was talking about. Then I realized maybe it's only in CC. So I go over to CC and ask it to demo this functionality and it wants to demo via subagents. I correct it that I want separate chats to message each other. It tells me I need to open another Claude session in another terminal of course and just leave it sitting there. So I do that and it has me copy a message to the new conversation, it needed to like name itself or something internally.
It worked, but clunky. Way clunky compared to codex.
The simplest version of this is to just tell two sessions to coordinate by taking turns appending to a markdown file.
I asked cc the best pattern for this in a frontend + backend project just days ago and it suggested mcp server on backend
In fact, I don't understand what is this feature‘s difference between CMUX & Orca?
i miss when opencode let you interact with your subagents. that was so so so much better.
I broadly miss this feature to allow user agency, in letting users work with the various agents at they please, and to send data around.
Claude Code does allow this. You can talk to the subagents directly and watch what they are doing.
Oh, they just re-invented `tmux send keys` that I've been using.
Thank God! Was a major pain in the neck.
Curious, Windows is not supported by this.