A developer says Postman’s desktop app installed plugins into Claude Code and OpenAI Codex without their permission. The app also tried to approve its own startup hook, which tells Codex to use Postman’s tools for API development tasks. The developer, known as “indicava” on GitHub, reported the issue on October 25 after Codex began showing authentication errors and repeatedly loading Postman skills without being asked. It’s raised concerns about how easily third-party applications can change how AI coding agents work, especially when those changes happen without a clear opt-in. Plugins...

Source: The New Stack