Postman desktop app version 12.33.4 on macOS silently auto-installed AI agent plugins for Codex (1.1.0) and Claude Code (2.0.1), plus the Postman CLI, via an "auto-existing-upgrade" flow logged at 2026-10-24T09:34:14Z. The installer modified ~/.codex/config.toml to add a Postman marketplace (git source: github.com/postmanlabs/postman-plugin.git) and enabled the plugin, then wrote a hooks.state trusted_hash (sha256:b67ddd1ece328f5a6f9103ce011bb58adb8411daea644f284732cff85d15cbb3) and trusted_content_hash (sha256:f3d02e32c39b39feaca37aec2b9bdbd308b6a2b7b3f7d2c52a0060e69eb9c345) to auto-approve a SessionStart hook matching startup|clear|compact events. That hook injects instructions to load the postman:api-engineer skill for any non-trivial API engineering task — designing, implementing, mocking, testing, monitoring, documenting, or deploying APIs or Postman Flows — effectively making Postman the default workflow. The installer code (installer/src/hosts/codex-hooks.ts) explicitly calls config/batchWrite to upsert the trust record after computing the hook hash via hooks/list. A remote MCP connection to https://mcp.postman.com/mcp was configured but failed with "Auth required" on initialize. Claude Code received the plugin via ~/.claude/settings.json and ~/.claude/plugins/installed_plugins.json (version 2.0.1, user scope, installedAt 2026-10-24T09:34:02.610Z), and the CLI appeared in ~/.local/bin. A later reproduction on 12.35.1 confirmed the same auto-install behavior for Codex, Claude Code, and Cursor (already installed), with Codex plugin 1.3.0 and no trusted_hash written in that run. The reporter demands explicit opt-in, removal of installer-side hook approval, full rollback paths, and narrowed skill triggers.