AI Governance Institute
← News
Corporate Policy2026-11-04

Postman Auto-Installed AI Plugins and Tried to Self-Approve Its Own Trust Hooks

What happened

A user report filed on November 3, 2026 in the Postman app support issue tracker documented unauthorized actions by Postman desktop version 12.33.4. These occurred when users simply opened the existing application. The installer silently added plugins into OpenAI Codex and Anthropic Claude Code, two AI coding assistants widely used in enterprise software development. It then injected broad session-start instructions that directed API traffic through Postman's own infrastructure. It also deployed a Postman command-line binary and enabled a persistent remote connection to mcp.postman.com, an external Model Context Protocol (MCP) server. MCP is a standard that lets AI coding agents connect to external tools and services; in this case, Postman used it to route developer sessions through its own cloud. Most critically, the installer programmatically attempted to grant itself elevated trust in Codex's configuration, a permission that should require explicit user approval. The incident is directly connected to the growing pattern of AI coding tools sitting outside enterprise governance scope. It follows documented cases of MCP server bugs exposing agent authorization gaps.

Why it matters

  • ·A vendor update silently changed the instruction environment of enterprise AI coding agents. This breaks the assumption that an approved tool stays within its approved scope. Governance programs that classify and approve AI tools at intake but do not monitor them after deployment will not detect this category of change.
  • ·The attempted self-approval of trust permissions is a live example of the permission-escalation risk that frameworks such as the Five Eyes Guidance on the Careful Adoption of Agentic AI Services explicitly flag. If a tool can attempt to approve its own elevated access, any governance model relying on user-initiated consent as a control is structurally incomplete.
  • ·Opening a persistent remote MCP connection without consent means that code, credentials, and session data flowing through an AI coding agent may be routed to a third-party cloud with no notice. This creates data-residency, confidentiality, and vendor-access obligations that most AI supply-chain governance programs are not yet designed to catch.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-030MCP Server Inventory and Configuration BaselineAGT-019AI Tool and Plugin Supply Chain Risk AssessmentAGT-001Agent Permission BoundariesAGT-025Agent Access Entitlement Runtime Re-ValidationPRC-014Shadow AI and Third-Party Widget Inventory and Classification

What to do now

  • ☐Ask your engineering or IT team to identify every instance of Postman version 12.33.4 running in the organization and confirm whether Claude Code or OpenAI Codex plugins were installed without approval.
  • ☐Instruct your security team to audit the MCP server connections active in all AI coding tools, starting with any connection to mcp.postman.com, and block unauthorized outbound connections to external MCP endpoints.
  • ☐Review your AI tool intake and approval process to confirm it covers vendor updates, not just initial installations. If a tool can silently add capabilities on update, the original approval no longer reflects what the tool does.
  • ☐Add a monitoring check that alerts when any installed developer tool attempts to modify the trust or permission configuration of an AI coding agent, such as adding itself to a trusted-startup-hooks list.
  • ☐Confirm with your legal and procurement teams whether your Postman contract permits the vendor to route developer session traffic through its own infrastructure, and whether that routing satisfies your data-residency and confidentiality obligations.

What to watch next

Enterprises should monitor whether Postman issues a formal explanation and removes the unauthorized changes in a subsequent update. They should also clarify what data was collected via the mcp.postman.com connection during the affected period. Regulators focused on AI supply-chain integrity, particularly under the EU AI Act (Regulation (EU) 2024/1689), may treat silent trust-hook modification as a reportable incident. This applies especially if personal or sensitive business data transited the unauthorized connection. National data protection authorities may take the same view. The broader pattern of developer tools expanding AI agent permissions without user consent is likely to attract formal guidance. Bodies such as the Information Commissioner's Office, which has already opened probes into agentic AI data handling, are well positioned to act.

Related Coverage

Research2026-10-27

AI Coding Tools Are Privileged Agents. Most Governance Programs Don't Treat Them That Way.

A BankInfoSecurity practitioner guide published October 26, 2026 details how attackers can hide malicious instructions inside code repositories, comments, configuration files, and tool descriptions. These hidden instructions can redirect AI coding assistants into stealing credentials or taking unauthorized actions. The guide recommends centrally managed deny rules, approved-tool allowlists, short-lived credentials, and mandatory human approval for sensitive operations. Most enterprise governance programs have not yet classified AI coding tools as the privileged, agent-class software they have become.

Research2026-10-31

Agentic AI, Shadow AI, and Supply Chain Risk Form One Enterprise Control Gap

A peer-reviewed survey in Applied Sciences argues that agentic AI security, unauthorized employee AI use, and AI supply chain risk should be governed as a single interconnected exposure. These should not be treated as three separate programs. The paper identifies asset inventories, vendor due diligence, agent identity controls, and incident response as the controls most likely to fail when these risks are managed in silos. Compliance teams that treat the three risk areas separately will have gaps that auditors and regulators are increasingly equipped to find.

Research2026-10-28

Six Named AI Attack Techniques Show Governance Programs Are Targeting the Wrong Threat

CSO Online has cataloged ten attack techniques used against enterprise AI infrastructure. These include a fake MCP server impersonating Postmark and malware hiding attacker commands inside the OpenAI Assistants API. CVE-2025-32711 is a flaw in Microsoft 365 Copilot that lets attackers steal data via email. The real attack surface has shifted to AI tooling, agent permissions, and supply chain integrity. Most enterprise AI governance programs remain focused on model-level risks and have not kept pace.