Opening Postman on my Mac was followed by unexpected changes to my coding agents: recurring MCP authentication warnings and Codex repeatedly routing API work through Postman skills. Investigation found a user-wide Postman plugin, a startup instruction hook, a remote MCP connection, a Claude Code plugin, and a separately installed Postman CLI.
I consider automatically changing unrelated coding agents and attempting to approve your own instruction hook a severe consent and trust-boundary problem. An API client should not make itself the default workflow in other tools simply because I opened it.
Postman desktop: 12.33.4. Codex Postman plugin: 1.1.0. Installed source revision: 6c8e452e0f4237f4bcc0901cb1ac442dec707e49. Investigation: October 25, 2026.
