SendMessage: inter-agent messages arrive with no sender provenance, making legitimate coordinator relays indistinguishable from injection
Summary
When one Claude Code session/agent messages another via the SendMessage tool, the receiving agent gets the message body wrapped in a caution notice (correctly warning it is not user input), but with no authenticated sender identity or provenance metadata it can verify. The receiver cannot distinguish (a) a legitimate relay from the coordinator session that spawned it, (b) a message from an unrelated peer, or (c) injected content.
Impact in multi-agent fleets
We run a coordinator session that spawns worker agents (Agent tool) and coordinates them via SendMessage. Because deliveries carry no verifiable sender, security-conscious workers rationally refuse relayed instructions — including instructions the coordinator relays verbatim from the human operator. In one working day we hit repeated 'refusal spirals': agents holding on correct, human-authorized instructions because the relay channel is structurally unverifiable, requiring out-of-band workarounds (posting the human's words to a GitHub issue tracker so agents could verify them there, or respawning agents with the authority in the founding prompt, which IS trusted).
The current design creates a paradox: the harness rightly teaches agents to distrust unattributed messages, then strips the attribution from every message.
Suggested fix
Include an authenticated envelope with each delivery: sender agent id/name, the sender's relationship to the receiver (spawner / sibling / unrelated), and ideally the spawn lineage root. Agents could then apply sensible trust policy (e.g., 'my spawner's messages carry the same authority as my founding prompt') instead of blanket distrust.
Environment
Claude Code CLI v2.1.207, Linux; observed across background agents spawned with the Agent tool and messaged via SendMessage.
Related: #75565 (resume dropping the model override) — a different bug, but it interacts: the workaround of respawning instead of messaging (to carry authority in the founding prompt) is what surfaces that one.