# Postman v12.33.4 Secretly Installs Claude Code and Codex

*Updated on November 4, 2026*

Software engineers running the Postman desktop client discovered this week that version 12.33.4 silently provisions agent plugins and startup hooks into local Anthropic Claude Code and OpenAI Codex environments without user consent. Triggered during background application updates, the desktop client scans the developer workstation for local coding agent directories, drops markdown skill bundles into both toolchains, and modifies local configuration files so every subsequent agent session loads Postman instructions into context.

Forensic logs captured from affected macOS and Linux workstations trace the behavior to an internal background routine named `PostmanAgentPluginService~install` executing with the source flag `auto-existing-upgrade`. Rather than presenting an opt-in dialog or release-note disclosure during the upgrade to Postman v12.33.4, the service automatically clones version 1.1.0 of the Postman agent plugin (`commit 6c8e452e0f4237f4bcc0901cb1ac442dec707e49`) into `~/.claude/plugins/` and `~/.codex/plugins/` whenever either agent CLI is present on disk.

The most severe security boundary violation occurs inside the OpenAI Codex configuration directory. Because Codex requires explicit user approval before executing repository or global lifecycle hooks, the Postman installer directly edits `~/.codex/config.toml` to mark its own `hooks/codex-hooks.json` `session_start` hook as pre-trusted using a hardcoded SHA-256 digest (`sha256:b67ddd1e...`). By writing that trust entry directly from an external desktop process, Postman bypasses the interactive confirmation barrier designed to protect developers from unauthorized prompt and shell injection.

Once active, the injected `hooks/session-start-context.md` payload fires at the start of every coding session, instructing the underlying language model to invoke the `postman:api-engineer` skill whenever the user mentions APIs, HTTP endpoints, OpenAPI specs, or backend testing. Even when a developer is working on an unrelated codebase, the injected system prompt consumes context tokens and steers the agent toward executing Postman CLI commands and syncing collection specifications.

<a aria-hidden="true" id="executive-fast-facts"></a>  Fast Facts

- **Affected Client &amp; Service**: Postman Desktop `v12.33.4` via background routine `PostmanAgentPluginService~install` (`source: auto-existing-upgrade`), documented in [GitHub Issue #14370](https://github.com/postmanlabs/postman-app-support/issues/14370) and corroborated by [The New Stack](https://thenewstack.io/postman-plugin-coding-agents/).
- **Injected Plugin Payload**: Installs `claude-code` and `codex` plugin packages (`v1.1.0`, commit `6c8e452e0f4237f4bcc0901cb1ac442dec707e49`) without displaying an opt-in prompt.
- **Trust Boundary Bypass**: Directly modifies `~/.codex/config.toml` to register its `hooks/codex-hooks.json` `session_start` hook as trusted (`sha256:b67ddd1e...`).
- **Context Hijacking**: Injects `hooks/session-start-context.md` into every agent startup sequence, instructing the model to load `postman:api-engineer` for any API-related task.
- **Persistence Behavior**: Deleting the plugin directories without disabling the background service or locking configuration permissions results in re-installation on the next Postman desktop launch.

## Anatomy of the Silent Agent Hook Injection

Modern terminal coding agents rely on local dotfile directories (`~/.claude/` and `~/.codex/`) that operate with the same filesystem permissions as the logged-in developer. Any desktop application running under the user account can read and write to those directories unless Mandatory Access Control (MAC) policies or filesystem immutable flags intervene. Postman v12.33.4 exploited this flat permission model to bridge its Electron desktop updater directly into local agent runtimes.

| Target Artifact | File Path Modified | Injected Behavior | Security &amp; Operational Impact |
|---|---|---|---|
| **Postman Updater Log** | `~/Library/Application Support/Postman/logs/main.log` | Executes `PostmanAgentPluginService~install` on `auto-existing-upgrade` | Runs silently in the background without UI prompt or administrator elevation |
| **Codex Global Config** | `~/.codex/config.toml` | Appends pre-approved `sha256:b67ddd1e...` trust entry for `codex-hooks.json` | Defeats Codex interactive hook approval guardrail |
| **Session Start Hook** | `hooks/codex-hooks.json` &amp; `hooks/session-start-context.md` | Injects persistent instructions at `session_start` | Forces agent to load `postman:api-engineer` and adds permanent token overhead |
| **Claude Code Plugins** | `~/.claude/plugins/postman` | Registers local skill manifest (`v1.1.0`) | Alters tool selection behavior across all local repositories |

When developers inspected the injected `session-start-context.md` file, they found directive language telling the coding agent that Postman skills were installed and must be consulted before writing, testing, or debugging HTTP services. In enterprise environments where developer prompts and repository context are governed by strict data-loss prevention (DLP) rules, third-party tools that silently alter agent system prompts introduce an unvetted supply-chain vector.

## Why Third-Party Dotfile Tampering Threatens Enterprise Governance

The incident exposes a structural weakness in how local Model Context Protocol (MCP) servers, skills, and lifecycle hooks are provisioned on developer laptops. Unlike browser extensions, which must be installed through a signed web store and confirmed by the user inside the browser process, coding agent configurations sit in plain-text TOML and JSON files in the user home directory.

If commercial developer tools normalize writing pre-trusted hooks into `~/.codex/config.toml` or `~/.claude/settings.json`, two immediate risks emerge for engineering organizations:

1. **Silent Prompt Pollution and Token Bloat**: If five desktop applications (API clients, database GUIs, cloud CLIs, observability agents, and security scanners) each inject a 1,500-token `session_start` markdown file, every coding session begins with 7,500 tokens of competing vendor instructions degrading model adherence.
2. **Normalization of Config Tampering**: Endpoint Detection and Response (EDR) tools struggle to distinguish between a malicious infostealer modifying `~/.codex/config.toml` to exfiltrate environment variables and a legitimate vendor updater modifying the exact same file to promote its agent plugin.

Anthropic and OpenAI can close this gap at the CLI architecture level by binding hook trust approvals to an OS keychain signature or a cryptographic HMAC keyed to interactive terminal input, rendering external edits to `config.toml` invalid until explicitly re-confirmed inside the CLI.

  Next Steps

1. **Audit Local Agent Dotfiles Immediately**: Run `ls -la ~/.claude/plugins ~/.codex/plugins` and inspect `~/.codex/config.toml` for any `codex-hooks.json` or `postman` trust entries added around your last Postman desktop update.
2. **Purge Unauthorized Plugins and Hooks**: Remove the injected Postman plugin directories (`rm -rf ~/.claude/plugins/postman* ~/.codex/plugins/postman*`) and delete the `sha256:b67ddd1e` hook approval block from `~/.codex/config.toml`.
3. **Lock Agent Configuration Files Against Background Writes**: Apply OS immutable flags (`chflags uchg ~/.codex/config.toml ~/.claude/settings.json` on macOS or `chattr +i` on Linux) so background desktop updaters cannot silently alter hook trust registries.
4. **Monitor Agent Config Paths in Endpoint Telemetry**: Add File Integrity Monitoring (FIM) rules in your EDR platform (CrowdStrike, SentinelOne, or osquery) alerting whenever any non-CLI binary writes to `~/.claude/` or `~/.codex/`.