Claude Code v2.1.229: Agent-to-Agent Messages Now Permission-Screened; Managed Agents Get Budget Caps

Claude Code v2.1.229 screens agent-to-agent messages through the permission classifier before dispatch, closing a prompt-injection vector; Managed Agents adds per-session budget caps and geo controls.

Claude Code v2.1.229 (August 12) adds a meaningful security layer for multi-agent workloads: any message dispatched to another Claude Code session via SendMessage now passes through the same permission classifier used for local tool calls before it reaches the target session. A compromised sub-agent can no longer silently instruct a parent session to run arbitrary bash or write to sensitive paths via a crafted message payload. The release also hardens synced skill/plugin directory naming on Windows, patches Remote Control session resume leaks, and restores CCR web-fetch/search proxy functionality after /clear.

Managed Agents — Anthropic's server-hosted agent sessions accessed via the API — now include per-session budget caps (set a token-spend ceiling in your API call; the agent stops and returns a structured error when reached) and geo controls (pin session processing to a specific AWS region for data residency compliance). GitHub-loaded skills — pointing a Managed Agent at a repo to load its .claude/skills/ directory on startup — are also now available.

Why it matters: The SendMessage permission screen is the kind of hardening that separates a toy multi-agent project from a production one. If your pipeline has agents that talk to each other, update to v2.1.229 before shipping to prod.

Sources: Claude Code changelog · Anthropic Release Notes — Releasebot