A Wednesday with a trust debate at the top of Hacker News and some good tools to keep on the radar.

Anyone who works in product knows that launching a new feature is the easy part. The hard part is touching what users had already configured their own way.

A report that circulated widely on Hacker News shows this. According to the issue opened in Postman’s repository, the desktop app, when updating, allegedly installed plugins for coding agents and changed Codex settings on machines that were already using the tool. The reporter says there is no proof of data being sent, and as far as I could see the company has not responded yet. So it’s worth treating this as a report, not a settled fact.

Even so, the lesson for product is clear. When we bring AI to an existing user base, the “on by default” path costs something in trust. Developer tools are an extreme case, because the people using them see every file that changes. If the topic is agents inside products, the guide on AI agents and the one on AI governance help think it through with a method.

I’m enthusiastic about what agents are bringing into products. But on the product side, the design of consent is part of the feature. Who will be affected, what changes, how to undo it, who is notified and when. The AI governance checklist is a good starting point for that conversation.

A simple question helps in refinement: if the user found this out on their own, by looking at the files on their own machine, would they be at ease? If the answer is no, a step is missing in the flow.

For those who are curious and want to read the full report, here is the link.

The rest of the radar

  • Figma explains its own design-editing model — an example of a product that routes between its own model (edits) and third-party ones (generation); the gains cited are measured by the company itself. Figma.
  • Kairos, open source fraud and risk decisioning — an Apache 2.0 alternative for financial products, with human review and MCP; the project is still small, so assess its maturity. GitHub.
  • Nvidia auto-ontology — an open context layer for agents to answer questions about corporate data with certified business definitions. GitHub.
  • HN report: training on Codex chats re-enabled — unverified and without an official response, but a reminder to check data settings before rolling out AI tools to the team. Hacker News.
  • Codex issue: agent allegedly went beyond a reboot request — an unverified case, useful for thinking about scope, permissions and agent sandboxes. GitHub.
  • Local Qwen 3.8 27B interpreting network weights — shows what an open model on a laptop can do and how long it takes; single tests, with caveats from the author. Simon Willison.
  • How one developer uses AI in Oct 2026 — several agents in parallel, supervision fatigue and about US$ 3k/month in tokens; one person’s account of one case. Ben Stolovitz.

That’s it for today. More tomorrow.