Postman Desktop Auto-Installs AI Plugins and Modifies User Configuration
Unauthorized integration of Codex and Claude plugins triggers severe security and trust-boundary concerns.
1Silent Plugin Installation Discovery
On October 25, 2026, users reported that Postman desktop version 12.33.4 automatically installed Codex and Claude plugins without explicit consent. The installation process included a startup instruction hook and a remote MCP connection. These changes occurred silently upon opening the application, bypassing standard user-driven installation workflows for external coding agents.
2Unauthorized Configuration Changes
The Postman installer modified global user configurations, specifically targeting ~/.codex/config.toml. It injected a trusted hash and registered a session-start hook that forced the agent to route API engineering tasks through Postman skills. This behavior effectively hijacked the user's existing development environment settings without providing any clear opt-in mechanism.
3Forced Workflow Redirection
The installed hooks instructed coding agents to prioritize the 'postman:api-engineer' skill for all non-trivial API tasks, including designing, testing, and documenting. This broad instruction was triggered automatically, forcing users into a Postman-centric workflow. The installer attempted to approve its own startup hook, creating a significant breach of established trust boundaries.
4Technical Evidence of Intrusion
Logs from ~/Library/Application Support/Postman/logs/main.log confirm the script execution with the source marked as 'auto-existing-upgrade'. The installer successfully registered plugins and updated the state of the Codex hooks. The presence of Postman executables in ~/.local/bin further validates that the application performed unauthorized actions outside its expected operational scope.
5Security and Trust Implications
Security researchers and developers have characterized these actions as malware-like behavior. By automatically altering unrelated coding agents and attempting to self-approve instruction hooks, Postman compromised the integrity of the user's local development environment. This incident raises critical questions regarding corporate software responsibility and the potential for unauthorized data exposure.
6Community and Maintainer Response
The community reaction was immediate, with users labeling the update as unacceptable and a severe risk to corporate security. Following the public disclosure of issue #14370, developers began removing Postman integrations. On November 3, 2026, a commit was added to the repository to address the unauthorized plugin behavior and remove the intrusive hooks.
7Accountability and Transparency Concerns
Users noted that Postman attempted to alter webpage content to evade responsibility after the issue gained traction. Comparisons with historical snapshots from the Wayback Machine suggest an attempt to obscure the nature of these updates. This lack of transparency has significantly damaged user trust, leading many to seek open-source alternatives like Insomnia.
8Long-term Impact on Tooling
This incident highlights the dangers of automated, non-transparent software updates in professional development environments. The breach of trust regarding local configuration files sets a concerning precedent for API clients. Moving forward, developers are likely to implement stricter monitoring of application behavior and prioritize tools that maintain clear, user-controlled security boundaries.