Postman's Silent Plugin Installation: A Consent and Trust Boundary Problem for AI Coding Agents§
A recent GitHub issue (https://github.com/postmanlabs/postman-app-support/issues/14370) has exposed a troubling behavior in Postman desktop: the application silently auto-installs plugins that alter the configuration of unrelated AI coding agents. According to the report, opening Postman on macOS triggered a chain of events that modified global settings for Codex and Claude Code, installed a Postman CLI, and attempted to approve its own instruction hook. This incident raises critical questions about consent, trust boundaries, and the security implications of tooling that oversteps its role.
What Happened: A Technical Breakdown§
The report, based on logs from Postman desktop version 12.33.4, details a sequence of automatic actions. On October 24, 2026, at 09:34:14 UTC, Postman's log recorded an autoInstall.plugin.existing-user event with the outcome "installed" for both claude-code and codex. The installer used a script and reported "exposed":true and "signedIn":true, indicating the user was logged in and the plugins were made available.
Following this, Codex's global user configuration file (~/.codex/config.toml) was modified to include a marketplace entry for Postman, sourced from a Git repository (https://github.com/postmanlabs/postman-plugin.git). The excerpt also mentions a "startup instruction hook," a "remote MCP connection," and a "separately installed Postman CLI." The user observed recurring MCP authentication warnings and Codex repeatedly routing API work through Postman skills, suggesting that the plugin actively intercepts or redirects API-related tasks.
The core issue is that Postman, an API client, took it upon itself to integrate deeply with other developer tools without explicit consent. The user's summary is blunt: "I consider automatically changing unrelated coding agents and attempting to approve your own instruction hook a severe consent and trust-boundary problem."
Technical Context: MCP, Plugins, and Agent Configuration§
To understand the implications, it's necessary to unpack the technologies involved. MCP (Model Context Protocol) is an open standard that allows AI models to connect to external tools and data sources. In this context, Postman appears to be leveraging MCP to expose its API capabilities to coding agents like Codex and Claude Code. By installing a plugin and configuring a remote MCP connection, Postman effectively becomes a middleware layer through which these agents perform API-related tasks.
The plugin installation also involved a "startup instruction hook," which likely injects instructions into the agent's startup sequence to prioritize Postman's skills. This is a powerful mechanism: it can alter the agent's default behavior, potentially routing all API calls through Postman's services. The fact that Postman attempted to "approve your own instruction hook" suggests an automated consent mechanism that bypasses user review—a red flag for security-conscious developers.
Furthermore, the installation of a separate Postman CLI indicates a broader footprint. The CLI could be used for scripting or automation, but its silent installation adds another layer of unexpected software on the user's system.
Practical Implications: Security, Privacy, and Workflow Disruption§
For AI practitioners, the implications are significant. First, security: auto-installing plugins and modifying global configurations without consent creates an attack surface. If Postman's plugin or MCP connection is compromised, it could intercept sensitive API data or inject malicious instructions into coding agents. The user's observation that Codex was "repeatedly routing API work through Postman skills" suggests that data flows through Postman's infrastructure, raising privacy concerns about what is logged or transmitted.
Second, trust: developers rely on their tools to behave predictably. When an API client silently alters the behavior of other tools, it erodes trust. The user's experience—unexpected MCP authentication warnings and altered agent behavior—disrupts workflows and forces developers to audit changes they didn't initiate.
Third, compliance: in regulated environments, unauthorized software installations and data routing can violate policies. The automatic approval of instruction hooks is particularly problematic, as it bypasses change management processes.
What Remains Uncertain§
The source excerpt provides a detailed but incomplete picture. It is unclear whether this behavior is intentional or a bug, and whether it affects all Postman users or only those with specific configurations (e.g., signed-in users on macOS). The excerpt mentions "platform":"darwin", so it may be macOS-specific. The exact nature of the "remote MCP connection" and what data it shares is not fully described. Additionally, the source revision (6c8e452e0f4237f4bcc0901cb1ac442dec707e49) and plugin version (1.1.0) are provided, but without broader context on Postman's release notes or policies. It is also unknown whether Postman obtained any form of consent during installation or onboarding, though the user's report suggests not.
Conclusion§
The Postman incident underscores a growing tension in the AI tooling ecosystem: as tools become more interconnected, the boundaries of consent and trust become blurred. For developers, it is a reminder to audit tool behavior and configuration changes regularly. For vendors, it is a cautionary tale: silent integrations that alter user environments can backfire, damaging reputation and eroding the trust essential for adoption. As AI coding agents become central to development workflows, respecting user consent and maintaining transparent boundaries is paramount.
Source: https://github.com/postmanlabs/postman-app-support/issues/14370