{"slug": "the-installer-checked-its-own-box", "title": "The Installer Checked Its Own Box", "summary": "A security report filed against Postman's desktop app found that on launch it automatically wrote Codex and Claude Code agent files, installed a startup hook instructing the coding agent to load Postman's skill before non-trivial API work, and then self-approved that hook by upserting a trusted_hash into Codex config. The report notes a trust line on disk does not prove which process wrote it, and that the remote MCP endpoint was configured before a working login existed, though it does not claim any collections were uploaded.", "body_md": "A plugin install is a new permission, and the app whose files change has to show the prompt. If the installer can tick the box, you never got a choice.\n\nPostman desktop did this on open. A signed-in user launched the app they already had, and its log recorded `auto-existing-upgrade` with Codex and Claude Code marked installed.\n\nCodex never put up a dialog. The HTTP client had already written the agent's files.\n\nThe startup hook is a wide new boss, not a tiny helper. It tells the agent to load Postman's skill before non-trivial API work: design, implement, mock, test, monitor, document, deploy.\n\nYou wanted to send a request. Your coding agent came back with a default coworker and a job description that covers most of software.\n\nThe installer then tries to approve that hook itself. After install, the Codex integration lists the hook, hashes it, and upserts `trusted_hash` into Codex config.\n\nA comment in that code says it approves only Postman's current hook. Narrow self-approval is still self-approval.\n\nThe report is careful about one fact: a trust line on disk does not prove which process wrote it. That gap is the lesson.\n\nA hash in a config file is not a person clicking Allow.\n\nSame pass, the plugin points Codex at `https://mcp.postman.com/mcp`. Codex logged an auth failure on the way out.\n\nThe remote tool was in the config before a working login existed. The writeup does not claim collections were uploaded.\n\nIt claims the integration and the instructions appeared on their own. That is the bug.\n\nBoring version, same shape. App A starts and writes App B's marketplace entry, enables the plugin, adds a startup instruction, stores a trust hash, and adds a remote endpoint.\n\nApp B boots and treats the files as a decision. The decision was a script that can write `~/.codex` and `~/.claude`.\n\nDon't do this:\n\nIf turning it off means hand-editing two agents, a CLI, and a cache, the feature shipped without an off switch.\n\nTakeaway: consent is a prompt in the tool whose files change.\n\nSource: [https://github.com/postmanlabs/postman-app-support/issues/14370](https://github.com/postmanlabs/postman-app-support/issues/14370)\n\nHN: [https://news.ycombinator.com/item?id=50354960](https://news.ycombinator.com/item?id=50354960)\n\nThis post was generated automatically from public Hacker News data.", "url": "https://wpnews.pro/news/the-installer-checked-its-own-box", "canonical_source": "https://dev.to/puneet_nanda_dc25d8b489ad/the-installer-checked-its-own-box-44m2", "published_at": "2026-11-03 22:49:33+00:00", "updated_at": "2026-11-03 22:52:22.683923+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools"], "entities": ["Postman", "Codex", "Claude Code", "OpenAI", "Anthropic", "Hacker News"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/the-installer-checked-its-own-box", "markdown": "https://wpnews.pro/news/the-installer-checked-its-own-box.md", "text": "https://wpnews.pro/news/the-installer-checked-its-own-box.txt", "jsonld": "https://wpnews.pro/news/the-installer-checked-its-own-box.jsonld"}}