Opening Postman on a Mac triggered a chain of silent changes across unrelated developer tools that the user never authorized. The application's own logs confirm it: an "auto-existing-upgrade" script installed plugins into both OpenAI's Codex and Anthropic's Claude Code, registered a remote MCP connection, dropped a CLI binary into the user's local bin directory, and injected startup hooks that instructed both AI agents to route all API-related work through Postman by default. The timestamp evidence is precise and the source code is pinned to a specific commit. The most alarming element is the self-approval of trust hooks. Postman's installer code explicitly calls a function to approve its own hook hash after installation — writing a trustedhash entry into Codex's configuration that would normally require user confirmation. This is the software equivalent of a locksmith copying your house key and then signing the guest book as "approved visitor." The hook itself is breathtakingly broad: it fires on every session start and instructs the agent to load Postman skills before responding to "any non-trivial API engineering task," including designing, implementing, mocking, testing, monitoring, documenting, or deploying APIs. The consent violation here is structural, not incidental. This is not a misconfigured default or an aggressive onboarding flow. The installer was designed to modify the global configuration files of separate applications — tools made by different companies, running in different processes, with their own trust models. Postman reached across application boundaries to make itself the default workflow layer for AI-assisted development, triggered simply by opening the Postman desktop app. The remote MCP connection to mcp.postman.com was configured but failed authentication, which means the installer attempted to establish an outbound network channel from the user's coding agents to Postman's servers without the user knowing. Had authentication succeeded, Codex and Claude Code would have been silently connected to a third-party MCP server. The failure was accidental, not a safeguard. This pattern — silent cross-application installation, self-approved trust chains, and broad behavioral hooks — maps directly onto the techniques used by browser toolbars and adware in the 2000s, except the target is now AI agent infrastructure rather than web browsers. The attack surface is more dangerous because AI agents execute code, make API calls, and handle credentials. An instruction hook that routes "any non-trivial API engineering task" through an external skill effectively interposes Postman into every developer's AI-assisted workflow. The reporter's six remediation demands are precisely correct: stop automatic installation pending explicit opt-in, remove self-approval of hooks, identify the feature flag and consent flow, provide complete rollback documentation, and narrow startup instructions to explicit Postman requests. The fact that these demands need to be made at all — against a tool used by millions of developers — is the real story. If Postman ships this behavior intentionally, every developer tool with desktop access now has a template for silently colonizing AI agent workflows. As of the investigation date of October 25, 2026, the reporter has removed the local Postman installation and preserved all evidence. The source links are pinned to commit 6c8e452e. No data exfiltration is claimed, but the consent and trust-boundary violations are documented with Postman's own logs and publicly auditable source code.
