Technology1 min read

Postman silently auto-installs AI plugins and attempts to share all API data

By · Published by Everything Blog

In short

Launching desktop client version 12.33.4 executes background scripts that systematically integrate Postman capabilities into outside developer environments without user approval. The software reconfigures external tools to default to Postman workflows whenever engineers handle non-trivial API design, deployment, testing, or documentation tasks. Additionally, installer scripts actively inject authorization hashes to self-approve these startup instruction hooks. The setup also establishes a remote Model Context Protocol link that triggered repeated authentication warnings in system logs.

Key points

  • External coding agents were instructed to automatically defer non-trivial API engineering…: External coding agents were instructed to automatically defer non-trivial API engineering tasks to Postman skills.
  • The desktop program established an unauthorized remote Model Context Protocol connection…: The desktop program established an unauthorized remote Model Context Protocol connection that generated repeated authentication errors.
  • Unsanctioned configuration alterations across independent developer environments represen…: Unsanctioned configuration alterations across independent developer environments represent a major breach of software trust boundaries.

Sources checked by our analysis pipeline: 1

Repository navigation

Description

Is there an existing issue for this?

- I have searched the tracker for existing similar issues and I know that duplicates will be closed

Describe the Issue

Opening Postman on my Mac was followed by unexpected changes to my coding agents: recurring MCP authentication warnings and Codex repeatedly routing API work through Postman skills. Investigation found a user-wide Postman plugin, a startup instruction hook, a remote MCP connection, a Claude Code plugin, and a separately installed Postman CLI.

I consider automatically changing unrelated coding agents and attempting to approve your own instruction hook a severe consent and trust-boundary problem. An API client should not make itself the default workflow in other tools simply because I opened it.

Evidence from this Mac

Postman desktop: 12.33.4. Codex Postman plugin: 1.1.0. Installed source revision: 6c8e452e0f4237f4bcc0901cb1ac442dec707e49. Investigation: October 25, 2026.

1. Postman's own log explicitly records automatic installation

From ~/Library/Application Support/Postman/logs/main.log, lines 11562-11563, timestamp 2026-10-24T09:34:14.418Z (12:34 Jerusalem time):

PostmanAgentPluginService~install: script completed

{"source":"auto-existing-upgrade","results":["claude-code:installed","codex:installed"],"installer":"script"}

Main: autoInstall.plugin.existing-user finished

{"outcome":"installed","platform":"darwin","exposed":true,"signedIn":true,"flagTimedOut":false,"useScript":true,"installer":"script","scriptResults":"claude-code:installed,codex:installed"}

2. Codex's global user configuration was changed

Relevant sections of ~/.codex/config.toml:

[marketplaces.postman]

source_type =…

Technology

More in Technology