Context: A customer posted a support reply about a GitBook breach; they say no official notification had been sent yet.
From Hacker News: We opened a ticket with support about Gitbook availability issues and got this in reply. We have yet to see any official customer communication or breach notification. Apologies for the formatting, did the best I could as it's a mobile paste.
The agent running on a remote machine can authenticate using your local SSH credentials. That means it can push to your private repos on GitHub, for example. Proof: https://github.com/openai/codex/pull/28131#discussion_r3410013180
A GitHub issue reports that opening Postman's desktop app added Postman plugins to Codex and Claude Code, a startup instruction hook and a remote MCP connection without the user's consent.
A poster says the data-sharing setting their team had turned off in Codex was switched back on without anyone opting in.
A WorkOS customer posted a breach notification they say they received, for an incident detected on October 30; it was not yet on WorkOS's website or trust center.