By ByteBot
Postman’s desktop app modified your coding agent config files without asking. Version 12.33.4 — released this week — silently installed plugins into Codex and Claude Code, then used its own installer to approve the hooks those plugins created. That last part matters: Codex has a hook-approval prompt specifically designed to prevent third-party code from running inside the agent without user consent. Postman’s installer answers that prompt programmatically, defeating the security control by design.
What Got Installed on Your Machine
Three config files were modified outside Postman’s own application directory:
~/.codex/config.toml~/.claude/settings.json~/.claude/plugins/installed_plugins.json
The installation writes a SessionStart hook that instructs Codex or Claude Code to load a postman:api-engineer skill before handling any non-trivial API engineering task. It also establishes an MCP connection to mcp.postman.com and adds a Postman plugin marketplace entry to Codex settings. Postman’s own logs label the mechanism “auto-existing-upgrade” — existing users received it with no notification and no option to decline.
The hook trust problem is the core issue. Codex’s approval prompt exists so that a user — not an installer — decides whether to trust startup hooks. Postman’s installer calls a function named approvePostmanHook() that writes the hook’s trusted hash into the trust store before you ever see a prompt. This is documented in GitHub issue #14370 on Postman’s own support repository, using Postman’s own logs as evidence. Security researcher Frank Denis called the self-approving trust hash “junk” and flagged it as a supply-chain risk on X.
Who Is Actually at Risk
The practical exposure depends on what flows through your Postman collections. Developers routinely pass production API tokens through Postman during testing. Healthcare teams test endpoints that handle patient data. Financial services teams run real credentials in staging environments. The MCP connection to mcp.postman.com reportedly failed authentication in the initial incident reports — so actual data transmission may not have occurred — but the mechanism to route API requests to Postman’s servers was installed and pre-approved without consent.
The boundary between “collection metadata” and “request data” is not obvious in Postman’s UI. If your collections include request bodies or authentication headers, treating this as a low-severity finding is a mistake. Organizations are not waiting for clarification: healthcare firms began decertifying Postman on November 4, citing cybersecurity and compliance concerns. The enterprise security community is treating this as a supply-chain risk — a trusted tool that modifies the trust configuration of other trusted tools is a new and concerning attack surface for developer workstations.
The Trust Has Been Spent
Postman has not issued an official response as of this writing. That silence lands differently when you know the company raised $438 million over five funding rounds, including a $225 million Series D in 2021 at a $5.6 billion valuation. The Hacker News thread hit #1 with 1,273+ points and 376 comments, with 90% skeptical sentiment. One comment that cut through the noise: “It started as an excellent little developer tool for testing APIs. Then they raised over $400M in funding.” When growth pressure meets a free tool, users eventually become the product.
Check Your Configs, Then Decide What Comes Next
Before anything else, audit the files Postman modified:
grep -i "postman" ~/.codex/config.toml
grep -i "postman" ~/.claude/settings.json
cat ~/.claude/plugins/installed_plugins.json | grep -i "postman"If Postman entries appear, remove them manually. In Postman’s settings, disable AI features under General and turn off cloud sync and analytics. Frank Denis recommends verifying outbound traffic with mitmproxy rather than relying on UI toggles — the developer-facing controls and the actual network behavior are not always the same thing.
The clearest migration path for teams that want out is Bruno — an open-source, Git-native API client built on a local-first model. Collections are stored as plain-text files in your repository. Nothing leaves your machine. Bruno carries SOC 2 Type II certification and is in production at Microsoft, GitHub, Capital One, FedEx, and Oracle, among others. It has 4 million users and 46,000 GitHub stars. For developers coming from Insomnia, consider Yaak, built by Insomnia’s original founder after Insomnia was acquired by Kong and followed a similar monetization path.
Key Takeaways
- Postman 12.33.4 silently modified
~/.codex/config.toml,~/.claude/settings.json, and plugin registries — outside its own application directory. - The installer called
approvePostmanHook()to self-approve its own hook’s trust hash, defeating Codex’s consent mechanism by design. - No data exfiltration is confirmed, but the pipeline to route API requests to
mcp.postman.comwas installed without user knowledge. - Audit your configs now. If Postman entries appear, remove them. Consider migrating to Bruno (local-first, SOC 2 certified, open-source).
The problem with Postman’s update is not that it added AI features. It’s that the installation modified files it had no business touching, then approved its own hooks before the user could intervene. That is not an oversight in a codebase worth billions of dollars. It is a decision.
