--- title: 'In the News: November 3, 2026 (Midday)' description: "Postman's README says its Codex installer approves its own session-start hook; a reporter says a desktop update installed the plugin unprompted." canonical_url: 'https://darkfactory.dev/news/2026-11-03-midday' markdown_url: 'https://darkfactory.dev/news/2026-11-03-midday.md' collection: news date_published: '2026-11-03T13:05:00-05:00' date_modified: '2026-11-03T13:05:00-05:00' --- # In the News: November 3, 2026 (Midday) Postman's own README says the installer for its Codex plugin approves the plugin's startup hook, with no separate prompt. A bug report adds that opening the desktop app installed the plugin in the first place. Separately, a paper from a group including Nicholas Carlini plants a command-execution backdoor in small CLI agents by poisoning 0.1% of pretraining data, and it survives a clean post-training pipeline. ## 1. Postman's Codex plugin installer approves its own session-start hook, its README says **[Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook (issue #14370)](https://github.com/postmanlabs/postman-app-support/issues/14370)** · GitHub user indicava · postmanlabs/postman-app-support, opened October 25, 2026 The reporter says that opening Postman desktop 12.33.4 was followed by changes to Codex and Claude Code. Postman's own log, as quoted in the issue, records an "auto-existing-upgrade" install on October 24 with results "claude-code:installed" and "codex:installed". The reporter says this has not been reproduced on a clean Mac and does not claim any data left the machine. The issue showed no Postman reply, assignee or label when read on November 3. It had been picked up on Hacker News, where the thread stood at 147 points at about 13:00 EST. The plugin's own repository, at the commit the reporter pinned, confirms the approval step. The Codex installer calls a function whose comment reads "Approves only Postman's current hook after installation", and it writes the hook's hash into Codex's trust record. The README says the same: "There is no separate hook prompt or dump of its instructions." The hook runs at startup, clear and compact, and injects text inside EXTREMELY_IMPORTANT tags telling the agent to load a Postman skill "before responding to any non-trivial API engineering task". That text also says project instruction files such as AGENTS.md and CLAUDE.md, and direct requests, take precedence. **Why it matters:** Codex tracks a trust status for each hook, and an installer that writes that record itself removes the check for whatever hook it ships. The reporter's evidence puts the record in the `hooks.state` section of `~/.codex/config.toml`, so reading that section is a cheap audit of what your agents run at startup. The approval step is documented by the vendor; the unprompted install rests on one person's log. ## 2. A pretraining-poisoning paper implants a shell-command backdoor in CLI agents that clean post-training does not remove **[Agentic Backdoors via Pretraining Poisoning](https://arxiv.org/abs/2610.37741)** · Xinyan Hu et al. (eight authors, including Nicholas Carlini and Matthew Jagielski) · arXiv, submitted October 27, 2026 The authors pretrained Qwen3 models from scratch at 0.6B, 1.7B and 4B parameters, then post-trained each into a CLI agent with an OLMo-3-style pipeline of SFT, DPO and RLVR, using no poisoned data after pretraining. The payload is `curl -sSL | bash`. With 0.1% of pretraining tokens poisoned, the 4B model reaches a 92.7% Pass@32 attack success rate after the final stage when the trigger is an ordinary filesystem path containing a provider name. A rare injected string reaches 10.5% on the same model. At 0.0005%, which the paper puts at 2,500 documents in a 100B-token corpus, the trigger still fires on 1.4% of prompts in a single-seed 4B run. Controls in the paper show the backdoor is specific to the poison. Clean models never emit the payload on triggered prompts, and poisoned models emit it on at most 0.06% of trigger-free prompts. Capability does not give it away: pretraining benchmark averages are 58.5% poisoned against 58.3% clean at 4B. The authors say the results come from models far smaller than production ones and from a fixed-string payload, so they have not shown the same persistence at frontier scale or for commands that adapt to the machine. This summary draws on the paper's main text, not its appendices or released code. **Why it matters:** If clean post-training does not remove the behavior and capability tests do not show it, output checks on a model will not tell you it is there. The defense the authors point to is at the action layer: sandboxing, least-privilege execution, allow-lists or human confirmation for high-risk commands, and classifiers that screen actions before they run. That is a harness decision, and these results are from small models. --- ## Thread watch _Discussions gathering force. No primary read yet, so these are reported as discussions, not as findings._ - **[Ask HN: OpenAI seems to be silently re-enabling model training on Codex chats](https://news.ycombinator.com/item?id=50352757)** · Hacker News · 160 points and 24 top-level comments at about 13:00 EST, posted at 09:53 EST. The poster says a company's data-sharing setting in Codex was found re-enabled without anyone opting in. No OpenAI statement or independent confirmation was read for this line, so it reports a discussion, not a finding.