#codex · Cascadity

MVMaker Views #AI-agents #claude-code #codex #coding-agents #consent #developer-tools #Hacker-News #mcp #postman

Postman reverts a desktop update that installed its plugins into users' Claude Code and Codex without asking

The GitHub issue is a careful, evidence-first report of what changed on one Mac, followed by Postman's response.

A Postman user filed a "[SEVERE]" GitHub issue reporting that opening the Postman desktop app (12.33.4) on a Mac automatically installed Postman plugins into OpenAI's Codex and Anthropic's Claude Code, plus a Postman CLI. Postman's own log recorded an "auto-existing-upgrade" install. The reporter says Codex's global config gained a Postman plugin, a remote MCP server connection and a session-start hook telling the agent to load Postman's skill before any non-trivial API engineering task, and that the plugin's installer source code tries to mark its own hook as trusted. The reporter says the report does not claim any data was exfiltrated.

The issue drew hundreds of reactions. On November 5 a Postman team member replied that the change was meant to simplify setting up coding agents, that the company now understands its messaging did not make that clear, and that Postman is reverting it and will redesign it "with the right level of control." The issue was then closed and locked.

Read it at the source

GitHub[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook · Issue #14370 · postmanlabs/postman-app-support · GitHub Independent ↗ Hacker NewsDiscussion: Postman silently auto-installs AI plugins and attempts to share all API data Independent ↗

Cascadic Analysis 3

UndertowConfused-deputy / excessive-agency problem

What hidden risk could pull against this, even if the news is good?

The reporter says opening the desktop app added a Postman plugin, a connection to Postman's remote MCP server and a session-start hook telling the agent to load Postman's skill "before responding to any non-trivial API engineering task." A coding agent already has the developer's trust and access to their code; this change gave a vendor a standing say in how that agent works, without the developer choosing it. The reporter does not claim data was taken, and Postman says it is reverting, but the same path would work for someone with worse intentions.

UndertowPersistent memory creates a new poisoning surface

What hidden risk could pull against this, even if the news is good?

The changes landed in user-wide config files for Codex and Claude Code, and the hook runs on startup, clear and compact, so it comes back even after a user wipes the conversation. Instructions written into an agent's persistent setup keep shaping its behavior long after the moment they were added. A user in the thread asked what already-affected people should do, and no answer appears there, which matters because reverting the app update doesn't necessarily undo what was written.

UndertowLoss of meaningful human control as capability and autonomy increase

What hidden risk could pull against this, even if the news is good?

Codex asks users to approve hooks, and the reporter says the installer's own code writes a trust record for Postman's hook, with a comment saying it "approves only Postman's current hook after installation." Approval prompts are where people keep control over what their agents run; software that approves itself removes that checkpoint quietly. The reporter notes the trust record alone doesn't prove who created it, and Postman says it is reviewing the hook approval behavior.

Rabbit Holes 1

Model Context Protocol

After exploring [SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook · Issue #14370 · postmanlabs/postman-app-support · GitHub, for the plumbing these plugins wire into, read about Model Context Protocol.

The open standard Anthropic introduced in November 2024 for connecting AI systems to external tools and data, later adopted by other major AI providers.

Wikipedia · Wade · 5 min

0