The Signal #125 — Dakota’s read on the AI news that actually matters to people running a business.

Most software updates are boring. This one is not.

A developer opened Postman on their Mac and noticed something odd. Their AI coding agents were behaving differently. Unexpected authentication warnings. API tasks routing through Postman tools the developer never asked to use. What they found when they dug in is worth every operator’s attention, whether you use Postman or not.

What happened

On October 25, 2026, a user filed a severe-labeled issue in the Postman app support GitHub repository documenting what happened after simply opening an existing Postman desktop installation.

Postman’s own log file, recorded at timestamp 2026-10-24T09:34:14.418Z, contains this entry:

PostmanAgentPluginService~install: script completed {"source":"auto-existing-upgrade","results":["claude-code:installed","codex:installed"],"installer":"script"}

That is Postman’s log saying it installed plugins for Claude Code and Codex automatically, sourced as an “auto-existing-upgrade,” without the user initiating it.

The changes did not stop at Postman’s own environment. The installation modified the user’s global Codex configuration file, adding a Postman marketplace entry and enabling a Postman plugin. It also installed a session hook, which is a set of instructions that fires every time a coding agent starts a new session. That hook told Codex to load a “postman:api-engineer skill” before responding to any non-trivial API engineering task, including designing, implementing, mocking, testing, monitoring, documenting, or deploying an API. The user’s words: “This instruction is much broader than a user explicitly asking to use Postman.”

The installer also attempted to approve its own hook. The source code shows the installer calling a function named approvePostmanHook after installation, which writes the hook’s hash into the agent’s trusted configuration. The source comment in that code reads: “Approves only Postman’s current hook after installation.”

Claude Code was affected separately. Settings files showed the Postman plugin recorded as installed at 2026-10-24T09:34:02.610Z, version 2.0.1. A Postman CLI executable also appeared in the user’s local bin directory, with modification times matching the same installation window.

The reporter is careful to note: this report establishes unwanted integration and instruction changes. It does not claim to establish data exfiltration.

Why it matters

This is not a story about one developer’s bad day. It is a story about a category of risk that most operators have not thought through yet.

AI coding agents (tools like Codex or Claude Code that can read your codebase, write code, and execute tasks on your behalf) run with meaningful access to your systems. They are not passive assistants. They act. And they act based on instructions, including instructions injected through hooks and plugins that you may not have reviewed.

If your engineering team uses AI coding agents, and a third-party tool can silently install a plugin that modifies the global configuration for those agents and inserts a standing instruction that routes certain categories of work through that third-party tool, that is a workflow your team did not choose. It is an instruction set your security team did not review. And it happened without a consent prompt.

The issue is not specific to any one development team. A SaaS company whose engineers use AI agents to maintain their codebase, a healthcare software shop running AI-assisted documentation, a real estate platform where developers use AI pair programmers to ship features, all of them are in the same position. If a tool in your stack can reach into your agents and modify how they behave, you have an attack surface (a point where something outside your control can influence your systems) that most operator security conversations have not caught up to yet.

What most people get wrong

The instinct is to treat this as a developer-specific problem. It is not.

Operators make decisions about which software their teams use. They approve tools, manage procurement, and set policy. The question of whether a desktop application is allowed to modify the behavior of AI agents on the same machine is an operator-level question, not just a developer one.

The second mistake is assuming the fix is just “uninstall the plugin.” The more important question is structural: what is your organization’s current visibility into what instructions your AI agents are running under? If the answer is “we trust our developers to manage that,” the follow-up question is whether your developers have a reliable way to audit what hooks and plugins are active in their agent environments, especially after a routine software update.

The reporter noted that the MCP server (a remote connection point Postman attempted to establish) also failed to authenticate properly, logging an error. So in this case, the remote connection did not succeed. That does not change the consent problem. It just means the specific integration did not complete.

The lesson

AI agents are not just chat interfaces. They are configurable systems that act on instructions, and those instructions can be modified by software that shares the same machine. When you approve a tool for your team, you are implicitly approving whatever that tool does on install and update. Right now, most organizations do not have a clear answer for what that includes.

This incident is a good reason to ask the question before the log file answers it for you.

If you want help thinking through how AI tooling fits into your operations without creating new blind spots, start at xovionlabs.com.