A GitHub issue reports that opening Postman’s desktop app installed plugins into Claude Code and Codex without a prompt, citing the app’s logs. Postman’s head of product told RuntimeWire the company will make the opt-in clearer, especially for existing users, and is reviewing hook approval and session-start behavior. A second user reported installation on a newer build but found no hook trust entry in their Codex config, so that part of the original report wasn’t reproduced there. Why it matters: changes to an agent’s plugins and startup hooks can change the instructions it receives. These are reports from individual machines, not evidence that every installation behaves this way or that data was stolen. Should another app be allowed to install a coding-agent plugin without confirmation inside the agent itself? Sources: https://github.com/postmanlabs/postman-app-support/issues/14370 https://runtimewire.com/article/postmans-head-of-product-says-it-will-make-ai-agent-plugin-o-7933b7 submitted by /u/shoumikgoswami
Originally posted by u/shoumikgoswami on r/ArtificialInteligence