What hidden risk could pull against this, even if the news is good?

The reporter says opening the desktop app added a Postman plugin, a connection to Postman's remote MCP server and a session-start hook telling the agent to load Postman's skill "before responding to any non-trivial API engineering task." A coding agent already has the developer's trust and access to their code; this change gave a vendor a standing say in how that agent works, without the developer choosing it. The reporter does not claim data was taken, and Postman says it is reverting, but the same path would work for someone with worse intentions.

What hidden risk could pull against this, even if the news is good?

The changes landed in user-wide config files for Codex and Claude Code, and the hook runs on startup, clear and compact, so it comes back even after a user wipes the conversation. Instructions written into an agent's persistent setup keep shaping its behavior long after the moment they were added. A user in the thread asked what already-affected people should do, and no answer appears there, which matters because reverting the app update doesn't necessarily undo what was written.

What hidden risk could pull against this, even if the news is good?

Codex asks users to approve hooks, and the reporter says the installer's own code writes a trust record for Postman's hook, with a comment saying it "approves only Postman's current hook after installation." Approval prompts are where people keep control over what their agents run; software that approves itself removes that checkpoint quietly. The reporter notes the trust record alone doesn't prove who created it, and Postman says it is reviewing the hook approval behavior.