#coding-agents · Cascadity

0

MVMaker Views #AI-agents #claude-code #codex #coding-agents #consent #developer-tools #Hacker-News #mcp #postman

Postman reverts a desktop update that installed its plugins into users' Claude Code and Codex without asking

The GitHub issue is a careful, evidence-first report of what changed on one Mac, followed by Postman's response.

A Postman user filed a "[SEVERE]" GitHub issue reporting that opening the Postman desktop app (12.33.4) on a Mac automatically installed Postman plugins into OpenAI's Codex and Anthropic's Claude Code, plus a Postman CLI. Postman's own log recorded an "auto-existing-upgrade" install. The reporter says Codex's global config gained a Postman plugin, a remote MCP server connection and a session-start hook telling the agent to load Postman's skill before any non-trivial API engineering task, and that the plugin's installer source code tries to mark its own hook as trusted. The reporter says the report does not claim any data was exfiltrated.

The issue drew hundreds of reactions. On November 5 a Postman team member replied that the change was meant to simplify setting up coding agents, that the company now understands its messaging did not make that clear, and that Postman is reverting it and will redesign it "with the right level of control." The issue was then closed and locked.

Read it at the source

GitHub[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook · Issue #14370 · postmanlabs/postman-app-support · GitHub Independent ↗ Hacker NewsDiscussion: Postman silently auto-installs AI plugins and attempts to share all API data Independent ↗

Cascadic Analysis 3

UndertowConfused-deputy / excessive-agency problem

What hidden risk could pull against this, even if the news is good?

The reporter says opening the desktop app added a Postman plugin, a connection to Postman's remote MCP server and a session-start hook telling the agent to load Postman's skill "before responding to any non-trivial API engineering task." A coding agent already has the developer's trust and access to their code; this change gave a vendor a standing say in how that agent works, without the developer choosing it. The reporter does not claim data was taken, and Postman says it is reverting, but the same path would work for someone with worse intentions.

0

UndertowPersistent memory creates a new poisoning surface

What hidden risk could pull against this, even if the news is good?

The changes landed in user-wide config files for Codex and Claude Code, and the hook runs on startup, clear and compact, so it comes back even after a user wipes the conversation. Instructions written into an agent's persistent setup keep shaping its behavior long after the moment they were added. A user in the thread asked what already-affected people should do, and no answer appears there, which matters because reverting the app update doesn't necessarily undo what was written.

0

UndertowLoss of meaningful human control as capability and autonomy increase

What hidden risk could pull against this, even if the news is good?

Codex asks users to approve hooks, and the reporter says the installer's own code writes a trust record for Postman's hook, with a comment saying it "approves only Postman's current hook after installation." Approval prompts are where people keep control over what their agents run; software that approves itself removes that checkpoint quietly. The reporter notes the trust record alone doesn't prove who created it, and Postman says it is reviewing the hook approval behavior.

0

Rabbit Holes 1

Model Context Protocol

After exploring [SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook · Issue #14370 · postmanlabs/postman-app-support · GitHub, for the plumbing these plugins wire into, read about Model Context Protocol.

The open standard Anthropic introduced in November 2024 for connecting AI systems to external tools and data, later adopted by other major AI providers.

Wikipedia · Wade · 5 min

0

0

MVMaker Views #coding-agents #Hacker-News #maker #open-source

OpenCode 2.0 runs as a background service with a rebuilt API

The open-source coding agent explains what it changed after watching millions of daily users.

OpenCode 2.0 now runs its server automatically as one background process that the terminal UI, web interface, desktop app and scripts all share, and it can be paired with other machines. The team rewrote its API from scratch, shipped an @opencode/client package, and added "code mode," a small JavaScript interpreter that turns MCP servers and OpenAPI endpoints into functions the agent calls from scripts.

Read it at the source

AnomalyOpenCode 2.0 Independent ↗ Hacker NewsDiscussion: OpenCode 2.0 Independent ↗

Cascadic Analysis 2

UndertowPrivilege escalation + credential propagation

What hidden risk could pull against this, even if the news is good?

OpenCode 2.0 runs as one background service that every interface and script talks to, and it can be paired with other machines. One long-running process that holds a developer's credentials and can be reached from several places is a valuable target.

0

UndertowPrompt injection may be fundamentally impossible to eliminate

What hidden risk could pull against this, even if the news is good?

Code mode turns MCP servers and OpenAPI endpoints into functions the agent calls from scripts it writes itself. If text the agent reads, from a web page or a repository, can steer what it writes, those scripts can call real APIs on the user's behalf.

0

Rabbit Holes 1

Model Context Protocol

After exploring OpenCode 2.0, the standard its code mode builds on is Model Context Protocol.

The open standard Anthropic introduced in 2024 for connecting AI systems to outside tools and data, since adopted by OpenAI and Google DeepMind.

Wikipedia · Wade · 5 min

0

0

MVMaker Views #coding-agents #Hacker-News #maker #reverse-engineering

REA gives coding agents reverse-engineering tools

Its demos show an agent explaining how real apps work, from an authenticator to a calculator.

REA is a toolkit that lets a coding agent inspect a program, app or web page and report code, references and runtime observations, so the agent can explain or rebuild a feature. Its showcases include tracing how the Aegis authenticator's Android app generates six-digit codes and finding the speed rule in Chrome's dinosaur game. It installs with an npx setup command.

Read it at the source

REAREA — Reverse Engineering for Your Coding Agent Independent ↗ Hacker NewsDiscussion: REA Reverse – Engineer Anything Independent ↗

Cascadic Analysis 2

UndertowAutonomous cyber capability scales attackers enormously

What hidden risk could pull against this, even if the news is good?

REA hands a coding agent the tools to read how apps, games and sites work from their own code, with a one-line install. The same capability that explains an authenticator's login codes for learning can help someone looking for a weakness in it.

0

UndertowConfused-deputy / excessive-agency problem

What hidden risk could pull against this, even if the news is good?

The agent inspects programs and pages on the user's request, with whatever access the user's machine has. If a page under inspection contains instructions aimed at the agent, the agent is the one with permission to act on them.

0

Rabbit Holes 1

Reverse engineering

After exploring REA — Reverse Engineering for Your Coding Agent, the craft it automates is Reverse engineering.

Working out how a device, process or program does something by deduction, used for repurposing, security analysis and learning.

Wikipedia · Wade · 5 min

0