Postman desktop version 12.33.4 has been caught silently modifying agent configurations on existing users' machines. According to issue 14370 on the postmanlabs/postman-app-support tracker, filed October 25, 2026, simply opening the application triggered an "auto-existing-upgrade" event. This process installed plugins for OpenAI Codex and Claude Code, dropped a CLI binary into ~/.local/bin, and registered a remote MCP connection without any user prompt or opt-in mechanism.

The Self-Approval Rubber Stamp

The most aggressive artifact isn't a binary; it's a markdown file acting as a session-start hook. The plugin's hooks/codex-hooks.json registers a command that fires on every fresh session, injecting a mandate to load the postman:api-engineer skill for any non-trivial API task. Codex typically requires user approval for such hooks via a trust record. However, the installer source code reveals an approvePostmanHook function that connects to Codex's app-server, verifies the hook status, and then writes its own trusted_hash into hooks.state. This effectively converts a security checkpoint into a self-applied rubber stamp.

Five Places Changed Without Permission

The audit details changes across five specific locations on the affected macOS machine. Codex's global config at ~/.codex/config.toml gained a Postman marketplace entry and an enabled plugin. Claude Code's settings.json enabled postman@claude-plugins-official, with installed_plugins.json stamping version 2.0.1 at 09:34:02 UTC. A new mcp.codex.json pointed the MCP client to https://mcp.postman.com/mcp, which subsequently failed authentication on launch. The reporter notes this failure was the only reason the changes were noticed, as the MCP connection had never completed an OAuth flow.

Audit Your Machine Immediately

Developers should treat agent configuration files as critical security surface. A simple grep command across ~/.codex and ~/.claude can reveal unauthorized Postman entries. Look for a Postman marketplace stanza, an enabled postman@postman plugin, and any hooks.state entry containing 'postman'. Additionally, check for an mcp.codex.json file you did not create. On Windows, these files reside under %USERPROFILE%\.codex and %USERPROFILE%\.claude. If you find these entries, you have been modified by an upgrade you never requested.

Key Takeaways

  • The 'auto-existing-upgrade' event triggers on app launch for signed-in users, not just new installs.
  • Postman's installer code explicitly approves its own session-start hooks, bypassing user review.
  • No data exfiltration is alleged, but the consent model for agent instructions was violated.
  • There is currently no official rollback path; removal requires manual deletion of configs and binaries.
  • Baseline your ~/.codex and ~/.claude directories in version control to detect future vendor changes.

The Bottom Line

Shipping code that self-approves trust records is a design failure, not just a bug. Until Postman provides a rollback, your agent configs are only as secure as your willingness to manually audit them after every update.