Postman silently auto-installs AI plugins and attempts to share all API data
Source
github.com
Author
sidgarimella
Date
Why it matters
A desktop app reportedly modified users' coding AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → configs without consent, so check your Codex and Claude Code plugin and agent hookA script the harness runs automatically at a fixed point in an agent's loop — before a tool call, after an edit, on session start.Full definition → directories for unexpected entries after installing API tooling.
Terms in this piece · Glossary
agent hook — A script the harness runs automatically at a fixed point in an agent's loop — before a tool call, after an edit, on session start.
MCP — The Model Context Protocol — an open standard that lets any AI assistant plug into any tool or data source without custom integration code.
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
