You open Postman. It installs itself into your Claude Code and Codex, adds a startup hook, and tries to mark that hook as trusted

That’s what a bug report on Postman’s own tracker says, and other users say they’ve reproduced it.

The report says the Postman desktop app auto-installed plugins into both agents, added a hook that routes API work through Postman skills, and attempted to self-approve it. Opening the app was the only trigger, according to the reporter. A second user hit it on upgrade; more have since said the same. Nobody is claiming data theft, because the remote MCP connection failed authentication. As of the morning of November 4, Postman had not responded.

My read: agents are the new browser toolbars. Every desktop app wants a hook inside yours, and the consent model hasn’t caught up.

Your pick: after any app update, look at your agent configs: ~/.codex/config.toml, ~/.claude/settings.json, and your hooks. Treat anything an app has written into those files as untrusted input. And if you’re the one building an agent integration: ask once, clearly, before you install anything.

12 months: agent platforms add consent prompts for third-party hooks.
24 months: agent config changes get the audit norms browser extensions have.
36 months: “what can modify my agent” is an enterprise policy question.

Why I may be wrong: a handful of macOS reports so far, so the scope may be narrower than it looks. Am I overreacting to a bad rollout?

When did you last open your agent’s config file to see what else had been in there?