Postman bundles CLI, plugins into AI agents

The author examines the implications of software vendors automatically installing command-line tools, plugins, and startup configuration hooks into developers' coding agent setups. Pointing to an incident involving Postman where session-start hooks were bundled without distinct user consent for configuring agent behavior, the article argues that agent startup prompts have become valuable ad space and a potential security risk. The author advises teams to inventory agent configurations, track diffs on tool updates, and treat agent instruction files with the same version-control rigor as code dependencies. Open article →