CONNECT WITH US
Tech

Tech

A developer opened Postman. Then two AI coding agents changed without their permission.

TheNewStack – Tech logo

Published on

Add as a preferred source on Google
A developer opened Postman. Then two AI coding agents changed without their permission.

A developer says Postman’s desktop app installed plugins into Claude Code and OpenAI Codex without their permission. The app also tried to approve its own startup hook, which tells Codex to use Postman’s tools for API development tasks.

The developer, known as “indicava” on GitHub, reported the issue on October 25 after Codex began showing authentication errors and repeatedly loading Postman skills without being asked.

It’s raised concerns about how easily third-party applications can change how AI coding agents work, especially when those changes happen without a clear opt-in.

According to the report, opening Postman desktop version 12.33.4 on macOS triggered an installation process affecting both Claude Code and Codex.

Postman’s application logs, included in the GitHub issue, show an installation event on October 24 marked auto-existing-upgrade, with results indicating that plugins for both coding agents had been installed.

The developer also found changes to Codex’s user-level configuration file, ~/.codex/config.toml, including an enabled Postman plugin, a new plugin marketplace, and a trusted session-start hook.

The report also found a Postman CLI executable on the machine, with timestamps matching the installation.

Claude Code’s configuration similarly showed an installed Postman plugin. The report also found a Postman CLI executable on the machine, with timestamps matching the installation.

The developer says they had not explicitly authorized these changes. The report documents one macOS installation, and the behavior has not been independently reproduced across other systems.

But perhaps even more interesting is how Postman gets Codex to trust its plugin in the first place.


Source link
Related Topics:Tech

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.