A recent GitHub report shows that launching Postman's desktop application on macOS triggered an automatic installation of plugins for Claude Code and OpenAI Codex, and the installer added a trusted session‑start hook to each agent’s configuration. The changes occurred without any explicit opt‑in from the developer, raising concerns for anyone who integrates AI coding assistants into their workflow.
What Changed in the AI Agent Environment
According to the issue filed by the developer “indicava”, opening Postman version 12.33.4 produced the following modifications:
- A log entry marked
auto-existing-upgraderecorded the installation of a Postman plugin for both Claude Code and Codex. - The user‑level configuration file for Codex (
~/.codex/config.toml) now contains an enabled Postman plugin entry, a reference to a new plugin marketplace, and a trustedsession‑starthook hash. - Claude Code’s configuration shows a similar Postman plugin entry.
- A Postman CLI executable appeared on the system with timestamps matching the installation event.
- Codex’s configuration also includes a remote MCP connection pointing to
https://mcp.postman.com/mcp, though authentication repeatedly fails.
The installer’s source code reveals that it checks for an existing trusted hook and, if absent, writes the hook’s hash directly into the agent’s configuration using a config/batchWrite operation. If the write cannot be confirmed, a log message prompts the developer to review the hook manually.
Operational and Security Implications
For AI engineers, platform engineers, and security practitioners, the silent modification of agent settings introduces several considerations:
- Toolchain integrity: Automatic plugin injection can alter the behavior of coding assistants, causing them to invoke Postman‑specific skills (e.g.,
postman:api-engineer) by default, even when the developer has not requested them. - Configuration drift: Changes to
~/.codex/config.toml and Claude Code’s settings occur outside the usual manual review process, making it harder to track the true state of the environment. - Hook trust model: The installer’s ability to self‑approve a session‑start hook bypasses the manual approval step that developers normally perform, potentially reducing confidence in the provenance of executed code.
- Network connections: The added MCP endpoint introduces an outbound connection that repeatedly fails authentication, which could generate noise in monitoring systems or mask legitimate traffic.
- Uninstall completeness: Postman provides an uninstall command, but the report indicates that it does not automatically revert configuration changes, plugin entries, or the trusted hook, leaving residual state on the host.
Mitigation and Visibility Steps
Practitioners can take the following actions to detect and remediate similar scenarios:
- Audit AI agent configuration files (
~/.codex/config.tomland Claude Code equivalents) for unexpected plugin entries or trusted hooks. - Verify the presence of unknown CLI binaries in the user’s PATH, especially those matching the Postman naming pattern.
- Review outbound network connections from development workstations for unexpected MCP or similar endpoints.
- If unwanted plugins are found, manually remove the entries from the configuration files and delete the associated CLI executable.
- Consider scripting a cleanup routine that restores the original configuration state after uninstalling Postman.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
The incident demonstrates that desktop tooling can modify AI agent environments without explicit consent, potentially altering automation behavior and expanding the attack surface. Teams should treat AI agent configuration as part of their broader system‑state inventory, enforce review of any automated changes, and ensure that uninstall processes fully revert all modifications. Ongoing vigilance—through configuration audits, network monitoring, and clear governance around third‑party tool installations—will help maintain the integrity of AI‑driven development pipelines.
