A recent report on GitHub highlights a significant shift in how the Postman desktop application interacts with external coding tools. Users have observed that simply opening the Postman app can trigger a series of automated actions, including the silent installation of plugins for AI coding agents like Codex and Claude. These actions appear to occur during an 'auto-existing-upgrade' process, which the reporter claims bypasses standard consent boundaries by modifying the environment of unrelated software.
The article discusses how Postman's installer modifies the environment of AI coding agents to automatically install plugins.
The mechanism behind these changes involves Postman's installer modifying global user configuration files. For example, the reporter identified changes to the `~/.codex/config.toml` file, which added Postman as a marketplace source and enabled a specific plugin. More significantly, the installation registered a 'SessionStart' hook. This hook provides instructions to the AI agent to route broad API engineering tasks—such as designing, mocking, or testing APIs—directly into Postman. This effectively makes Postman the default workflow for these tasks, even when the user has not explicitly requested the integration.
Beyond configuration changes, the report identifies a potential security and trust-boundary issue regarding how these hooks are validated. The Postman installer reportedly attempts to automatically approve its own 'trust hooks' by writing the hook's hash into the agent's trusted state. Additionally, the process enabled a remote Model Context Protocol (MCP) connection to `mcp.postman.com`, which may attempt to establish authenticated connections. While the report does not claim data exfiltration, it characterizes these automated integrations and self-approving trust records as a severe violation of the expected boundaries between independent developer tools. The reporter has called for a complete rollback path and a cessation of automatic installations pending explicit user opt-in.