Leading in the agentic era: How to put people first as you adopt AI agents
cloud.google.com·16h ago
Cloud & Infrastructure
The New Stack·10h ago·5 min read
He opened Postman. Then two AI coding agents changed without his permission.
TL;DR
A developer reported that Postman's desktop app installed plugins into Claude Code and OpenAI Codex without his consent, raising concerns about user control and software behavior.
✦ Why It Matters
Review your software settings to ensure you maintain control over installed plugins and integrations.
Key Takeaways
- Check for unauthorized plugins in your coding agents.
- Review Codex settings for unfamiliar hooks or connections.
- Request clearer permissions from third-party applications.
- Consider the security implications of automatic installations.
How It Works
Postman's installer can automatically approve a session-start hook for Codex, allowing it to load Postman's API tools without user consent. This is achieved by checking if Codex trusts the hook and modifying its configuration if it does not.