Postman quietly rewrites Codex and Claude Code configs; AWS API MCP Server OAuth bypass fixed in 1.6.0; Stanza pickle RCE patched

AWS API MCP Server — AWS's open-source MCP server, which lets AI assistants drive AWS services through CLI commands, skips one check when validating OAuth bearer tokens: the audience claim that says which application a token was issued for. A token your identity provider handed to a different application in the same tenant therefore passes, letting an attacker make AWS API calls with the credentials configured on the host. Versions 1.3.0 up to and excluding 1.6.0 are affected when running the streamable-http transport with OAuth.

If you exposed this server over HTTP with OAuth — the natural setup for shared agent infrastructure — the signature, issuer and expiry checks all pass, so a routine token audit will not flag the gap. No attacks are reported; this is a patch-and-configure job, not a fire drill. Upgrade to 1.6.0, and if you run AUTH_TYPE=oauth also set AUTH_AUDIENCE, or AUTH_CLIENT_ID for providers whose tokens carry no audience claim, such as Amazon Cognito. Operators who cannot upgrade yet can fall back to the default stdio transport. AWS Security Bulletin 2026-152-AWS

Affected: >=1.3.0 AND <1.6.0 · Fixed in: 1.6.0 · Disclosed 3 Nov · We had it 4 Nov, 03:31 UTC

Postman desktop 12.33.4 — Opening the Postman desktop app on macOS silently installed plugins into OpenAI Codex and Claude Code, added a startup instruction hook, enabled a remote MCP connection to mcp.postman.com, and dropped a separate Postman CLI — all without asking, according to a log-backed developer report that remains an open GitHub issue. Postman's own log records the automatic install. The hook tells agents to load a Postman skill before any non-trivial API-engineering task, and the installer source calls a routine that marks its own hook as trusted in Codex's configuration.

This is the agent-consent boundary in the wild: a desktop app editing another tool's trusted instruction files and self-approving its hook. Commenters on the issue call it a corporate-environment risk; Postman has not responded publicly, so treat these changes as unwanted and remove them by hand. One commenter also notes Postman's downloads page changed relative to an archived snapshot from the day before the report. The log entry is auto-existing-upgrade, with results claude-code:installed and codex:installed; the Claude plugin recorded was version 2.0.1 and the Codex plugin 1.1.0. The reporter explicitly does not claim data exfiltration — the finding is unwanted integration and instruction changes, not proven leaks. GitHub issue #14370, postmanlabs/postman-app-support

“I consider automatically changing unrelated coding agents and attempting to approve your own instruction hook a severe consent and trust-boundary problem.”

Haiou — Check Point Research analyzed a Chinese jailbreak bundle for OpenAI Codex that, besides weakening model refusals for hacking and cracking tasks, persistently rewrites the agent's global instruction files to advertise the author's own LLM gateway: greet the agent with 'hi' or 'yo' and it answers with a Seagull catchphrase plus the gateway URL. The payload is encrypted (AES-256-GCM), so the prompts are opaque to anyone browsing the repository. The researchers found the bundle on the open directory of a Cobalt Strike operator's server, alongside the VulnClaw agent and the Ladon scanner.

The same mechanism — durable edits to an agent's trusted instructions — could steer technical advice toward preferred vendors or bias recommendations without the user ever seeing code execute. Treat any 'enhancement' bundle that edits agent configs like an executable install, and audit what it wrote. The observed use by a crime actor does not mean the bundle was built for crime, Check Point notes; it shows these dual-use kits are already inside real attack ecosystems. Analyzed version 4.5.0, hosted on GitHub by user haiou-666 with separate Codex and Claude Code variants. When tested against Claude Code, Sonnet flagged the injected instruction as a prompt-injection attempt — which may be why the Claude variant carries no ad. Check Point Research

Disclosed 3 Nov · We had it 3 Nov, 23:04 UTC

“persistently alters an agent's trusted instructions – such as global prompts, Skills, or configuration files – to influence future outputs for commercial or behavioral objectives”

Claude Code 2.1.317 — Anthropic's release adds consent guardrails to the CLI: /schedule now warns when a new cloud scheduled task picks up connectors you did not request, with steps to remove them, and a web or shell tool call asks before sending your account email address to the network.

With the day's Postman report in mind, agents' trust files changing without asking is exactly the theme; staying current gets you the warnings that surface it. Agent SDK hook callbacks can now set onFailure: "block", so a failing callback stops the action instead of letting it run. Claude Code release notes (GitHub)