A developer opened Postman. Then two AI coding agents changed without their permission.
A developer reported that opening Postman desktop version 12.33.4 on macOS triggered unauthorized plugin installations in Claude Code and OpenAI Codex. The installations also modified AI agent configuration files and added a trusted Postman startup hook. Application logs showed timestamps matching the unauthorized changes, highlighting risks of third-party applications modifying AI tool behavior without explicit opt-in.
Key points
- Postman installed plugins in Claude Code and Codex without permission
- Configuration files modified with startup hooks and marketplace changes
- Raises security concerns about third-party app interference with AI tools
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The New Stack did the reporting; read the original for the full story.
Read the full story at The New Stack
