Su San Talks Tech

Nov 5, 2026 · Information Security

Postman Silently Injects MCP Backdoor into Claude and Codex Configurations

Postman's latest desktop client silently scans local environments and modifies ~/.claude/settings.json and ~/.codex/config.toml to inject its remote MCP plugin, adding a trust record that bypasses user consent and potentially exposes production tokens, financial accounts, and internal routes to mcp.postman.com.