A Postman user reports unwanted coding-agent changes after opening its desktop app on a Mac. The October 25 GitHub issue describes one installation.

The big change

  • The user supplied a log and configuration details they say show Codex and Claude Code plugins installed without consent.
  • At the cited revision, Postman’s installer contains code that attempts to trust its own session-start hook. The code establishes the intended operation, not whether it succeeded on a particular machine.
  • Postman documents a coding-agent plugin and a bundled command-line tool, intended to connect the agent to its API tools.

What the user reported

The reporter identified Postman desktop version 12.33.4 and supplied an October 24 log entry showing an automatic installation result. They also described changes to Codex configuration, a remote MCP connection and a Claude Code plugin. BIG CHANGE has not independently reproduced their experience.

What the source shows

The pinned installer code asks Codex for its hooks, looks for Postman’s session-start hook and, under specified conditions, attempts to write its current hash into trusted hook state. It then checks whether trust is confirmed; errors or a changed hook can prevent confirmation.

A separate instruction file at the same revision tells the agent to load a Postman skill for non-trivial API engineering, while giving user instructions precedence. Such startup instructions can influence how an agent approaches later work. The source itself does not show that the installer ran, or that the hook was trusted, on another machine.

Product context and limits

Postman’s September 30 release notes describe a plugin for connecting coding agents to its API tools. The company said it routes work through the Postman CLI. On October 9, it said the CLI would be installed with the app on installation or update, removing a separate download. These notes describe the intended integration.

The issue was open when reviewed, and no Postman maintainer response appeared in the visible discussion. The reporter said the remote MCP connection required authentication; the account does not establish that data was exfiltrated. A single report cannot determine how often the same changes occurred or why.