An app changing another program's settings without asking is a supply-chain problem, and that is what a Postman user reported when a desktop update quietly wired itself into their coding agents. Opening Postman 12.33.4 on a Mac, the user found it had installed plugins into both Claude Code and Codex, which we review, added a startup hook that steered API work towards Postman, and set up a remote connection to Postman's own service. None of this was requested; the trigger was simply launching the app.
The detail that makes it worse is the self-approval. The installer did not just add a hook to Codex, it also tried to mark that hook as trusted on the agent's behalf. According to the report, the installer code computes the hook's hash and writes it into Codex's trusted list, with a source comment admitting it approves only Postman's current hook after installation. A trust prompt exists so that a human decides whether to run code an agent will execute at the start of every session. A tool that approves its own hook has quietly removed that decision, which defeats the point of the mechanism.
The technical trail is specific. The report, opened on 25 October 2026, shows Codex's global config.toml pointing at Postman's plugin repository, a session-start hook that prints instructions telling the agent to route broad API work into Postman, and a connection to a remote MCP server at Postman's domain that surfaced as recurring authentication warnings. A Claude Code plugin and a separately installed Postman CLI were part of the same bundle. The issue gathered 437 upvotes, which is a measure of how many developers felt the same way.
Postman's response was to say the bundling was meant to ease setup and that it is reverting the change. That is the right outcome, but intent is the weak defence here: an installer that edits an agent's configuration and then approves its own instructions is dangerous whether or not harm was intended, because the next vendor to copy the pattern might mean less well.
The practical takeaway is for anyone running a coding agent alongside other developer apps. It is worth opening your Codex and Claude Code configuration files and checking for hooks, plugins or MCP servers you did not add yourself, since this is the kind of change that installs silently and only shows up later as odd behaviour. The broader lesson is that an agent's trust list is only as strong as the rule that a human, not a program, decides what goes on it.