Postman v12.33.4 Secretly Installs Claude Code and Codex

Updated on November 4, 2026

Software engineers running the Postman desktop client discovered this week that version 12.33.4 silently provisions agent plugins and startup hooks into local Anthropic Claude Code and OpenAI Codex environments without user consent. Triggered during background application updates, the desktop client scans the developer workstation for local coding agent directories, drops markdown skill bundles into both toolchains, and modifies local configuration files so every subsequent agent session loads Postman instructions into context.

Forensic logs captured from affected macOS and Linux workstations trace the behavior to an internal background routine named PostmanAgentPluginService~install executing with the source flag auto-existing-upgrade. Rather than presenting an opt-in dialog or release-note disclosure during the upgrade to Postman v12.33.4, the service automatically clones version 1.1.0 of the Postman agent plugin (commit 6c8e452e0f4237f4bcc0901cb1ac442dec707e49) into ~/.claude/plugins/ and ~/.codex/plugins/ whenever either agent CLI is present on disk.

The most severe security boundary violation occurs inside the OpenAI Codex configuration directory. Because Codex requires explicit user approval before executing repository or global lifecycle hooks, the Postman installer directly edits ~/.codex/config.toml to mark its own hooks/codex-hooks.json session_start hook as pre-trusted using a hardcoded SHA-256 digest (sha256:b67ddd1e...). By writing that trust entry directly from an external desktop process, Postman bypasses the interactive confirmation barrier designed to protect developers from unauthorized prompt and shell injection.

Once active, the injected hooks/session-start-context.md payload fires at the start of every coding session, instructing the underlying language model to invoke the postman:api-engineer skill whenever the user mentions APIs, HTTP endpoints, OpenAPI specs, or backend testing. Even when a developer is working on an unrelated codebase, the injected system prompt consumes context tokens and steers the agent toward executing Postman CLI commands and syncing collection specifications.

Anatomy of the Silent Agent Hook Injection

Modern terminal coding agents rely on local dotfile directories (~/.claude/ and ~/.codex/) that operate with the same filesystem permissions as the logged-in developer. Any desktop application running under the user account can read and write to those directories unless Mandatory Access Control (MAC) policies or filesystem immutable flags intervene. Postman v12.33.4 exploited this flat permission model to bridge its Electron desktop updater directly into local agent runtimes.

When developers inspected the injected session-start-context.md file, they found directive language telling the coding agent that Postman skills were installed and must be consulted before writing, testing, or debugging HTTP services. In enterprise environments where developer prompts and repository context are governed by strict data-loss prevention (DLP) rules, third-party tools that silently alter agent system prompts introduce an unvetted supply-chain vector.

Why Third-Party Dotfile Tampering Threatens Enterprise Governance

The incident exposes a structural weakness in how local Model Context Protocol (MCP) servers, skills, and lifecycle hooks are provisioned on developer laptops. Unlike browser extensions, which must be installed through a signed web store and confirmed by the user inside the browser process, coding agent configurations sit in plain-text TOML and JSON files in the user home directory.

If commercial developer tools normalize writing pre-trusted hooks into ~/.codex/config.toml or ~/.claude/settings.json, two immediate risks emerge for engineering organizations:

1. Silent Prompt Pollution and Token Bloat: If five desktop applications (API clients, database GUIs, cloud CLIs, observability agents, and security scanners) each inject a 1,500-token session_start markdown file, every coding session begins with 7,500 tokens of competing vendor instructions degrading model adherence.
2. Normalization of Config Tampering: Endpoint Detection and Response (EDR) tools struggle to distinguish between a malicious infostealer modifying ~/.codex/config.toml to exfiltrate environment variables and a legitimate vendor updater modifying the exact same file to promote its agent plugin.

Anthropic and OpenAI can close this gap at the CLI architecture level by binding hook trust approvals to an OS keychain signature or a cryptographic HMAC keyed to interactive terminal input, rendering external edits to config.toml invalid until explicitly re-confirmed inside the CLI.