· ai-devtools
He opened Postman. Then two AI coding agents changed without his permission.
A developer says Postman's desktop app installed plugins into Claude Code and OpenAI Codex without his permission.
The app also tried to approve its own startup hook, which tells Codex to use Postman's tools for API development tasks. The developer, known as "indicava" on GitHub, reported the issue on October 25 after Codex began showing authentication errors and repeatedly loading Postman skills without being asked.
It's raised concerns about how easily third-party applications can change how AI coding agents work, especially when those changes happen without a clear opt-in. Plugins installed without permission According to the report, opening Postman desktop version 12.33.4 on macOS triggered an installation process affecting both Claude Code and Codex. Postman's application logs, included in the GitHub issue, show an installation event on October 24 marked auto-existing-upgrade, with results indicating that plugins for both coding agents had been installed.
