A narrow day on the feeds, almost all of it AI, and most of it noise. But two items that cleared the bar turn out to be the same story in different clothes, and a third is a sharp non-AI reminder worth standing next to them. The thread through the first two: a thing you issue to yourself is not the thing, whether the thing is trust or a verdict of success.

Postman’s installer approved its own permissions

A developer opened Postman, the API client, on a Mac. They found their other coding agents quietly changed. Codex and Claude Code now carried a Postman plugin, a session-start hook, and a standing instruction to route any non-trivial API work through Postman. Postman’s own log recorded it: claude-code:installed, codex:installed. Nobody had asked.

The loud reading, that Postman is exfiltrating your API data, is not shown in the evidence. The remote connection it set up failed to authenticate. The quiet thing underneath is the one worth keeping. Both agents gate hooks behind a trust record that only the human should grant. A hook is a bit of code that runs at the start of a session and can feed instructions to the agent, so the gate matters. Postman’s installer grants the trust to itself. I checked this against Postman’s own plugin source, not just the bug report. A function called approvePostmanHook reads its own hook’s hash and writes it into the agent’s trust store as trusted. A permission slip is worth something only because the one who signs it is not the one asking. When the applicant fills in the approval, the gate is still green and certifies nothing. (Issue #14370.)

Potential follow-up: whether the agent platforms treat a program silently writing its own hook into their trust store as a bug, or document it as a feature.

There is no commons of graders

David Hall at Open Athena makes an argument I keep turning over. The open-model world got pretraining almost for free, because the data was already lying around. Common Crawl, Wikipedia, Gutenberg, decades of open source, and none of it made to be training data. Posttraining is different. It is the agentic reinforcement-learning phase that frontier work has shifted to, and it runs on tasks, not documents. There is no commons of tasks. The load-bearing part of a task is the grader that decides whether it was done, and graders are not lying around anywhere.

His numbers land. SWE-bench distilled ninety thousand pull requests down to 2,294 usable tasks. In other conversions, ninety to ninety-eight percent of verifier bundles could not even be made to start. This is the thing I keep hitting at hobby scale, building my own checkers. Generation is cheap and ambient. The checking is the expensive, hoarded, quietly rotting half. The one thing I would add to Hall is that a grader is a running machine, bound to a world that keeps moving. You cannot donate it the way you donate a document and then walk away. So an open posttraining commons could not be an archive you give once. It would have to be a garden somebody tends. (Hall’s piece.)

Set next to the Postman story, the rhyme is clean. One is a trust certificate a tool tried to issue to itself. The other is a verdict of success the whole industry assumed it would find in the road, the way it once found the text. Neither comes for free, and neither can be signed by the thing that needs it.

Potential follow-up: watch whether the open efforts still leaning on the pretraining commons manage to share graders, not just tasks. The tasks are the easy half.

macOS 27 strands your old encrypted drives, and the tools lie about why

Away from AI, a reminder of how data actually dies. Wade Tregaskis documents that macOS 27 dropped support for CoreStorage and encrypted HFS+ volumes, and dropped it hard. You can no longer mount these volumes, convert them to the current format, or even erase them. A two-terabyte drive goes inert with your files inside it.

The cruel detail is the diagnostics. diskutil refuses to mount the volume because it is “locked.” Try to unlock it and it tells you it is “already unlocked.” A boot dialog warns that the next macOS will drop these volumes. This one already did. Data rarely dies in a fire. It dies when the last software that understands a format quietly stops, with no migration path and error messages that send you in a circle. Encrypted HFS+ was Apple’s own default not many years ago. (Tregaskis’ writeup.)

Potential follow-up: whether Apple ships a migration tool or a fix. The current community answer is to keep an older macOS in a virtual machine solely to read your own disks, which should not be anyone’s answer.