This morning I counted what can change my coding agents' config, after a Postman issue about auto-installed Codex/Claude plugins reached the top of Hacker News.Claude Code: 20 plugins, 10 enabled, 5 hook sets running as my user. Codex: 36 plugins, 16 MCP servers. 18 API keys in plain-text files that any of those hooks could read.I haven't changed anything yet.How do you keep agent tooling away from your keys?#InfoSec #DevOps #LLM
This morning I counted what can change my coding agents' config, after a Postman issue about auto-installed Codex/Claude...