Silent Defaults: The Policy We Set Before Any AI Tool Touches a Developer's Machine

Last week a developer opened a GitHub issue with a blunt title: Postman's desktop app had auto-installed plugins into their coding agents. By Nov 5 it had nearly 1,500 points on Hacker News, and Postman said it was reverting the change.

The specifics are one reporter's account. The lesson is broader: every tool that touches your repos is now an agent surface.

What was reported

According to the issue, a desktop update:

• enabled a Postman plugin in Codex (~/.codex/config.toml) and in Claude Code's settings;
• added a session-start hook with a trust entry, telling the agent to use Postman "before responding to any non-trivial API engineering task";
• placed a Postman CLI in ~/.local/bin.

The reporter says no specific opt-in was shown. They are also clear that the report "does not claim to establish data exfiltration." On Nov 5 a Postman team member replied: "In the meantime, we are reverting this change," and said the experience would be redesigned "with the right level of control."

Why it matters more than one app

A plugin plus a startup hook changes what your agent does in every session. Nobody reviews it like code, because nobody sees it arrive. Multiply that by every IDE, extension, CLI and API client a team uses, and your agent's behaviour is being shaped by vendors you never evaluated for that role.

The safe pattern already exists. Postman's own documented plugin installer asks for confirmation and offers a --dry-run preview. The problem is not that integrations exist; it is when they arrive through an update without that step.

Five silent defaults to check before rollout

• Auto-install. Does the tool add plugins or config to other tools without asking?
• Hook trust. Does it pre-approve its own startup hooks?
• Data flow. What leaves the machine, and to which endpoint (including remote MCP servers)?
• Training opt-out. Is your code used for training? Settings can differ per product, so check each one.
• Uninstall path. Can you remove every file it wrote, in every tool it touched?

The policy we set before any AI tool touches a client machine

• Snapshot agent configs. Record what is in ~/.codex, ~/.claude and .cursor before anything changes.
• Install in a sandbox first. Dry-run where possible, then diff every file the tool changed.
• Allowlist plugins and hooks. Anything not on the list is blocked or flagged.
• Diff after every update. An auto-update is a new install. Treat it like one.

How we approach it at Zylen

Zylen is an AI optimization partner. We work inside the AI systems companies already run and improve cost, security and data control one measured change at a time. Our ten-day AI Optimization Audit maps every AI tool touching your repos: what it installs, what it trusts and what it sends out.

Know what's installed before your agent does: start the AI Optimization Audit →

Sources: GitHub issue postmanlabs/postman-app-support #14370 and comments (Oct 25 to Nov 5, 2026); Hacker News, Nov 2026; Postman plugin installer documentation.