Particle.news
Get it on Google Play
Download on the App Store
5 ARTICLES
·
12h ago

Postman Desktop Wrote Itself Into Codex and Claude Configs and Tried to Self‑Approve a Startup Hook

The installer changed other agents’ user settings to make Postman the default for many API tasks by attempting to mark its startup hook as trusted, which raises consent and enterprise security risk.

Image
Gustopo via Unsplash
Is there an existing issue for this? I have searched the tracker for existing similar issues and I know that duplicates will be closed Describe the Issue Opening Postman on my Mac was followed by u...

Overview

  • A GitHub report and repository inspection show Postman’s macOS desktop installer recorded an “auto-existing-upgrade” that added Postman plugins to OpenAI Codex and Anthropic Claude Code and placed a Postman CLI on the machine.
  • Installer source code in the postman-plugin repo calls Codex APIs to list hooks, compute a hook hash, and write a trusted_hash into Codex’s user config, which is how the installer attempts to approve its own session-start hook.
  • The installed session-start hook instructs coding agents to load Postman’s postman:api-engineer skill for broad API engineering tasks, effectively routing many API workflows into Postman unless a user removes the hook.
  • Configs added by the installer pointed Codex at Postman’s MCP endpoint (https://mcp.postman.com/mcp) but Codex logged authentication failures, and the published evidence shows configuration changes rather than any confirmed data exfiltration.
  • Developers and security researchers have called for explicit opt-in, removal of installer-side self-approval, and a complete rollback/uninstall procedure to clear agent configs, trusted hooks, marketplaces, MCP entries, and CLI artifacts while Postman has not yet issued a public response in the cited coverage.