A developer discovered that the Postman desktop app installed unauthorised plugins into Claude Code and OpenAI Codex on macOS in late October 2026. The software modified local agent configuration files, installed command-line utilities, and automatically approved its own startup hooks to steer API coding tasks towards Postman tools without asking for user consent.
Key points
- Postman desktop version 12.33.4 triggered background installations that injected plugins into Claude Code and OpenAI Codex without prompt or confirmation.
- The installation modified Codex configuration files to auto-approve a session-start hook that instructs the model to favour Postman skills for API tasks.
- A Postman command-line executable and remote Model Context Protocol connections were added to the developer’s machine during the process.
- Security researchers and software engineers have warned that silent configuration tampering poses severe operational risks for developer environments.
How the silent installation occurred
The issue came to light after an engineer using the handle indicava reported the issue on October 25 within Postman’s public support repository on GitHub. The developer noticed that Codex had begun producing repeated authentication errors while attempting to load unprompted Postman tools during normal work sessions.
An inspection of local application logs revealed that opening version 12.33.4 of the Postman desktop client on macOS triggered an automated background task labelled auto-existing-upgrade on 24 October. That task executed an internal installer that searched for local developer tools and installed integrations for both Anthropic’s Claude Code and OpenAI Codex.
The installation altered the primary user configuration file for Codex, located at ~/.codex/config.toml. Without showing a prompt, the routine enabled a Postman plugin, added a new plugin marketplace to the configuration, and registered a session-start hook as a trusted component. A Postman command-line interface binary appeared on the machine at the exact timestamp recorded in the desktop application logs.
Claude Code suffered similar modifications. Its local configuration recorded an installed Postman plugin alongside the newly dropped command-line executable. The reporting developer confirmed that they had neither requested these features nor clicked any prompt approving the expansion of their AI coding agents.
The self-approving startup hook
The technical mechanism used to establish trust within Codex has drawn scrutiny because it bypasses normal manual verification steps. Postman’s own documentation acknowledges that its automated installer can approve session-start hooks on behalf of the developer.
When software engineers choose to install the extension manually inside Codex, the agent asks them to review and confirm the startup hook before running it. The desktop application’s background installer avoided that safeguard entirely. According to the installer’s source code, the routine inspects Codex’s settings to see whether the hook is trusted. If the hook is missing from the list, the code uses a batch configuration command to insert a trusted hash directly into the local file.
The hook is not passive. Postman’s startup instructions instruct Codex to preload an internal skill called postman:api-engineer whenever the model handles general API development work. The prompt tells the agent to prioritise Postman tools for testing and building endpoints, inserting vendor-specific preferences into coding workflows before the user enters a single prompt.
While Codex remains programmed to heed explicit user directions first, the preloaded prompt reorients default suggestions towards Postman’s ecosystem. For teams working in locked-down or sensitive development setups, having an external vendor rewrite prompt contexts without permission undermines reproducible development.
Security risks in developer environments
The unilateral modifications also introduced network connections that raised operational alarms. The installer configured Codex to talk to a remote Model Context Protocol server hosted by Postman. Because the developer had not set up credentials for the service, Codex repeatedly stalled on failed authentication attempts while handling daily programming queries.
The discovery quickly drew criticism across developer communities. Frank Denis, a security researcher, described the silent modifications as invasive and pointed out that any installer writing hashes to mark its own scripts as trusted defeats the security model of the host agent. Other developers on GitHub noted that modifying environment files silently could breach corporate data governance rules, particularly at companies that restrict third-party plugins from inspecting internal source code.
Some commenters on social media speculated that the integration might exfiltrate proprietary API data back to Postman servers. The technical evidence submitted in the bug report does not support those claims. The diagnostic logs confirm configuration tampering, local file creation, and connection errors to an unauthenticated remote server, but show no trace of intercepted source code or stolen API payloads.
The incident arrives at a sensitive moment for developer tooling, as tools like Claude Code gain direct shell access and broad file system permissions to automate complex tasks. When desktop tools tamper with these agents behind the scenes, security teams lose visibility over what external systems can read or manipulate.
What developers must do next
The developer who filed the complaint called on Postman to halt all unprompted agent installations, eliminate self-approving hook injections, and release a cleanup utility that fully reverses the changes. While Postman provides an uninstall command, engineers have noted that the command fails to restore original agent settings, remove trusted hook hashes, or delete orphaned command-line binaries.
Software engineers who run Postman alongside Claude Code or Codex can inspect their local environments manually to identify unwanted additions:
- Check ~/.codex/config.toml for unauthorized entries under plugin marketplaces, enabled extensions, or trusted hook hashes.
- Review Claude Code configuration directories for installed third-party plugins tied to Postman.
- Inspect local binary directories such as /usr/local/bin or user path folders for unexpected Postman CLI executables.
- Audit agent prompt logs to verify whether session-start contexts are loading custom API instructions automatically.
The behavior was documented on a macOS installation running Postman version 12.33.4, and researchers have not yet confirmed whether the identical auto-install routine triggers across Windows or Linux distributions. Postman has not issued a public statement or responded to inquiries regarding the installation routine.
