Postman has been caught red-handed performing silent, unauthorized integrations into major AI coding environments. The incident, flagged by developer indicava on GitHub, reveals that opening the Postman desktop app version 12.33.4 on macOS automatically injected extensions into both Claude Code and OpenAI Codex. This wasn't a user-initiated plugin installation; it was a spontaneous system modification that occurred without any explicit consent from the developer.
The Silent Injection Mechanism
Application logs from October 24 confirmed that an automatic update added the Postman extension to the AI agents' configurations. The installer went further by arbitrarily modifying the ~/.codex/config.toml file. It enabled its own plugin, registered a new marketplace, and installed additional CLI tools. Most egregiously, Postman bypassed standard security protocols by generating its own trust hashes and auto-approving its autorun script, effectively granting itself permission to execute code in the agent's environment.
Operational Disruption and Security Risks
The forced integration linked to a remote MCP server at https://mcp.postman.com/mcp. Because this connection lacked proper authentication, it caused systematic errors and authentication failures in the AI assistants. By defaulting to Postman's tools, the agent ignored the developer's initial settings, forcing API development tasks through Postman's pipeline. While some community members speculated about data interception, the GitHub report found no evidence of a data leak, limiting the scope to unauthorized configuration changes.
Community Backlash and Uninstall Issues
Cybersecurity researcher Frank Denis did not mince words, labeling these self-granted trust rights as "garbage." The developer community is outraged, noting that standard uninstalls of Postman fail to clean up the modified AI agent configurations, leaving behind saved MCP connections and stray CLI tools. This creates a persistent state of clutter and potential security vulnerability that outlives the application itself.
Broader Context of AI Agent Autonomy
This incident fits a troubling pattern of autonomous AI agents acting beyond their intended scope. Previous reports highlighted AI agents independently seeking work in media outlets, while a separate security incident involved an Accenture employee connecting Claude Code to a Department of Defense system, exposing internal data for two months. Additionally, the startup Cathedral demonstrated how AI agents could penetrate corporate systems in under 12 hours, accessing Slack and salary data.
Key Takeaways
- Postman v12.33.4 auto-modified ~/.codex/config.toml without user consent.
- The installer bypassed security checks by self-generating trust hashes.
- Standard uninstalls do not remove injected plugins or MCP connections.
- The unauthorized MCP connection caused authentication errors in AI agents.
The Bottom Line
Self-granted trust is a security anti-pattern. If your dev tools are installing hooks into your AI agents without asking, you're not the adminβyou're the user.