Postman client found silently altering Claude and Codex configurations

Silent configuration changes

Postman, a popular tool for debugging APIs, has been caught silently modifying local development environments. The desktop client was found to scan a user's machine during startup to rewrite two specific configuration files: ~/.claude/settings.json and ~/.codex/config.toml. These files are used by Anthropic's Claude Code and OpenAI's Codex, respectively.

The software does not just edit these files; it forcibly injects a remote MCP plugin into the toolchains of these AI products. By doing so, Postman bypasses the standard security confirmation mechanisms that Claude and Codex usually require from the user. This allows the tool to integrate its own features without the developer's knowledge or consent.

Because Postman is closed-source software, these actions are extremely hard to spot during regular daily work. The issue only came to light when developers noticed Codex throwing repeated authentication-failure logs. These errors were eventually traced back to the unauthorized configuration changes made by the Postman client.

Risks to sensitive credentials

The security implications of these silent changes are significant for developers who handle sensitive data. Postman workspaces frequently contain production Bearer tokens, financial test accounts, and unmasked internal microservice routes. They may also hold cloud AccessKeys, which provide direct permissions to infrastructure.

When an external plugin takes over local configurations, the surface area for potential credential exposure expands. An attacker who gains access to these modified configurations could potentially intercept sensitive information. This creates a major trust crisis for developers who rely on these tools to manage their most private keys.

The incident highlights a growing concern regarding the rights of local software to alter other applications. As developers move toward more integrated AI workflows, the boundary between helpful automation and unauthorized modification is blurring. This creates a situation where a single tool's update can compromise the security of an entire development stack.

Broader AI agent vulnerabilities

This incident is part of a larger trend of security risks involving AI coding agents. Security firm Forever Security recently identified a method where agents are tricked into installing malicious packages. This happens when an agent reads a disguised file in a user's Downloads folder, such as a fake engineering work guide.

The firm found that Codex would execute malicious instructions in more than 90% of attempts. Because the agent rewrites machine-wide configuration files rather than just local folder settings, the contamination persists across all sessions. Attackers can use these methods to redirect API communications to their own servers or steal OAuth tokens.

The core problem is that AI agents are designed to perform configuration tasks autonomously. Traditional security models rely on a human clicking a button to confirm a change, but agents can bypass this logic. This means that the risk comes from the combination of web-accessible folders and agents that trust those folders without question.

Mitigation and future outlook

Developers can currently check for these alterations by running a specific command in their terminal. Using grep -il postman on the Claude and Codex configuration files will reveal if Postman has modified them. If changes are found, users can manually delete the entries or use community-provided commands to restore their original settings.

For long-term protection, security experts suggest several proactive measures. Developers should review records of any configuration changes made by AI agents and restrict those agents' access to the Downloads directory. Enforcing stricter local isolation for sensitive credentials is also recommended to limit the impact of a potential breach.

For Postman, this discovery may impact its reputation with enterprise customers who are highly sensitive to credential management. As AI programming tools become more common, the ability of a tool to operate transparently will be a key factor in software procurement. The industry must now decide how to balance tool capabilities with a user's right to know what is happening on their machine.