Claude Code sessions can message each other; PR auditors miss four in five staged attacks

554,000 views for a documentation page about inter-process communication. That is what happened on the evening of August 7, when Anthropic shipped cross-session messaging in Claude Code and the announcement went past half a million impressions overnight. The docs page is the substance: one session can list your other Claude Code sessions and send a message to a chosen one, on the same machine or across machines, and what crosses the wire is a summary rather than your conversation history or your files. The receiving session picks it up mid-task instead of waiting at a turn boundary. Hacker News had it on the front page by midday Saturday, and swyx pointed out that he had been approximating the same thing in OpenAI Codex since early August by @-mentioning threads and queueing the mention.

AINews built its Friday issue around the pattern, coining Zawinski’s Law of MultiAgents: every agent expands until it can message other agents. The joke is the hook; the numbers buried further down are the reason to read it. A SWE-bench Pro comparison found that swapping the agent harness moved pass@1 more than most model upgrades do, with GLM-5.2 ranging from 23% to 52% and Gemma 4 26B from 15% to 36% depending on scaffold. Harness rankings did not transfer between models at all, rank correlation -0.05, so the scaffold that wins for one checkpoint tells you nothing about the next. A 26B model in a good harness lands near a 744B model in a bad one. The same issue reports Databricks cutting internal AI coding spend by up to 90% in some scenarios while usage kept climbing, decomposed as roughly 50% from shifting defaults to cheaper models, 30% from routing, 10% from user-visible budgets, and 10% from pruning context bloat. Both findings point the same direction: the flagship checkpoint is no longer where the remaining gains live.

Addy Osmani’s Agentic Code Quality works the other end of that loop, and it is the most useful thing published in the last day on where human attention should go. His framing is that software quality now lives in the constraints you put around the agent, not in the agent: unit and property and acceptance tests, mutation testing, complexity and readability metrics, architecture rules enforced through linting, security scanning at the boundary. The sharp part is what he says about capacity. When agents generate changes faster than your verification system can consume them, you have exactly three moves, and you should be honest about which one you are making: scale the verification loop, throttle the rate at which agents produce changes, or lower the quality bar so verification pushes back less. Teams that do not choose deliberately end up doing the third one by accident. He also argues that a human checkpoint dropped into a machine-speed pipeline will cost you throughput, so pull humans in only when the automated guardrails break, and spend their judgment on the nuanced calls.

Which brings the week’s counterweight. PRWeaver, from Singapore Management University, asks whether LLM code auditors catch attacks distributed across several pull requests rather than packed into one. The benchmark is 208 execution-validated attacks across ten real repositories, each rendered four ways, 832 renderings total, evaluated against OpenCodeReview, Claude Code, and GitHub Copilot Code Review across six auditor-model pairings. Simply splitting an attack across commits costs detection at most five percentage points, so commit boundaries are not the mechanism. Interleaving 16 genuine upstream PRs between the malicious ones costs 5 to 13 points. Fusing each malicious component into a real maintainer diff under a description that plausibly explains both costs 10 to 18. The number that should worry anyone running batch review: under whole-window review at 24 interleaved PRs, detection falls to 16 to 22%, against 50 to 60% when the same PRs are reviewed one at a time. Hiding repository history costs only 4 to 11 points, which locates the failure squarely in what occupies the auditor’s active context at review time rather than in what it can reach. The strongest configuration tested, Claude Code on Sonnet 4.6, still let 34% of interleaved attacks through. One failure case is instructive: the auditor described both malicious changes correctly and then filed them as intentional security-usability tradeoffs, with no finding.

On the infrastructure side, Cloudflare launched Kitesurf, a browser built for AI agents, one day after shipping the persistent stateful compute environments covered here Friday. Between the two, plus the AI Gateway and Workers AI consolidation, Cloudflare is assembling a full agent substrate rather than a feature.

GitHub’s Copilot weekly release reads like a list of things people had been scripting themselves. The CLI gets a Sessions sidebar for juggling concurrent runs, an experimental /worktree that spins up an isolated worktree with its own conversation, a /rewind that restores files and conversation without needing Git, and live tool-call durations in the timeline so you can see which command is slow. VS Code 1.132 adds /btw, a side chat that shares context and the prompt cache from the primary conversation, so you can ask a question mid-turn without derailing the agent or paying to re-prime it. The integrated browser now takes element-level annotations you send to the agent as visual feedback. Auto in the desktop app now reports which model handled each request along with credit and cache details, which is the kind of transparency that makes routing policy debuggable.

Two other things worth knowing. Apple said Mac users in China can now connect to Alibaba’s Qwen service, a distribution deal that matters more for what it signals about regional model routing than for the feature itself. And Stripe published how it automated database incident recovery by modeling its global infrastructure as a graph and computing remediation plans with graph search plus state machines, no model in the loop. Worth reading next to the agent stories as a reminder of which problems are still better solved by a planner you can prove things about.

The thread connecting most of this: capability shipped fast over the last day at the coordination layer, and verification did not keep pace. Sessions can now talk to each other; auditors still cannot see an attack spread across a release window. Watch whether the next round of review tooling starts retrieving and linking security-relevant evidence across PRs, which is what the PRWeaver authors say is missing, or whether teams just widen the review window and hope.