Postman Shipped AI Plugins Into Claude Code and Codex Without Asking, and Its Own Code Approved the Hook
Postman bundled its CLI and AI agent plugins into the desktop app, and users say opening it rewrote Codex and Claude Code settings. The company promises a clearer opt-in but has published no fix date.
Postman’s desktop app installed its AI coding agent plugins into OpenAI Codex and Anthropic’s Claude Code when existing users opened it, according to application logs and configuration files published in a public GitHub issue.
The report, issue 14370 on Postman’s app support tracker, says Postman 12.33.4 on macOS logged an auto-existing-upgrade install at 09:34 UTC on 24 October 2026, and its config showed a trusted record for Postman’s Codex startup hook. A second user reported the same sequence on 3 November after the app updated from 12.31.3 to 12.35.1.
Postman’s head of product, Sarabmeet Kallar, told RuntimeWire that the company bundles the CLI and agent plugins to make setup easier and will make the opt-in clearer, especially for existing users. Postman has not published a release note, a fix date or a full rollback guide.
Quick answer: Postman’s public plugin code confirms that its installer approves the Codex startup hook without a separate prompt. The automatic install on upgrade is supported by user log excerpts and the company’s confirmation that the app bundles them, but not by an official changelog. If you opened Postman recently, inspect your Codex, Claude Code and Copilot settings.
What the report actually shows
The issue was opened on 25 October by a developer named indicava, who says opening Postman on a Mac produced MCP authentication warnings in Codex and pushed API work through Postman skills. Postman’s own log, quoted in the report, records the source as auto-existing-upgrade and the result as “claude-code:installed, codex:installed”.
The same report lists a new Postman marketplace and plugin entry in ~/.codex/config.toml, a Postman plugin enabled in ~/.claude/settings.json at version 2.0.1, and a Postman CLI binary in ~/.local/bin.
A second commenter posted a fuller log on 3 November: the app updated from 12.31.3 to 12.35.1 on launch, then installed the CLI and both plugins over 58 seconds. A third reported Postman entries in GitHub Copilot’s settings file.
The hook is the part that should worry you
Installing a plugin is visible. Approving the hook that feeds the agent standing instructions is the quieter move, and Postman documents it plainly. The plugin README says that for Codex, “installation also approves Postman’s session-start hook” and that there is “no separate hook prompt or dump of its instructions”.
The source is more explicit. In codex-hooks.ts, the function carries the comment “Approves only Postman’s current hook after installation”. It reads the hook hash through Codex’s hooks/list call and writes hooks.state with a trusted_hash through config/batchWrite.
The hook then prints a context file that begins with “EXTREMELY_IMPORTANT” and tells the agent to load the postman:api-engineer skill before “any non-trivial API engineering task”. The text does say that project instruction files and direct user requests take precedence, but it still makes Postman the default entry point for a broad category of work.
The plugin also wires a remote MCP server at https://mcp.postman.com/mcp through mcp.codex.json. Codex logs in the report show that connection failing with “Auth required” while it remained enabled.
What the installer wrote, by agent
| Agent | File reported changed | What appeared | Removal reported |
|---|---|---|---|
| OpenAI Codex | ~/.codex/config.toml |
Postman marketplace, enabled postman@postman plugin, hook trust entry |
In-app uninstall exists; not independently tested |
| Claude Code | ~/.claude/settings.json, installed_plugins.json |
postman@claude-plugins-official at 2.0.1, user scope |
In-app uninstall exists; not independently tested |
| GitHub Copilot | ~/.copilot/settings.json |
Postman marketplace and enabled plugin | One user says the in-app uninstall did not remove it |
| Cursor | Existing plugin directory | Postman plugin detected, not newly installed in one report | Not established |
| Shell | ~/.local/bin |
Postman CLI executable and library directory | Not established |
The README says the standalone installer supports nine agents in one pass: Antigravity, Claude Code, Codex, GitHub Copilot CLI, Cursor, Factory Droid, Kimi Code, OpenCode and Pi. That breadth fits an explicit install command, not a desktop app launch.
What is confirmed, and what is not
| Claim | Status | Evidence |
|---|---|---|
| Postman’s installer approves the Codex session hook itself | Confirmed | Plugin README and pinned installer source |
| The desktop app bundles the CLI and agent plugins | Confirmed | Postman download page sentence and head of product statement |
| Existing users get the bundle on upgrade without a clear prompt | Not confirmed by Postman | Two user logs; no official changelog |
| API data left users’ machines | Not confirmed | No evidence presented; reporter explicitly does not claim it |
| Which builds and how many users are affected | Unknown | No company disclosure |
| In-app uninstall removes Copilot entries | Disputed | One user report, not reproduced |
The “all API data” claim goes further than the evidence
The Hacker News headline says Postman “attempts to share all API data”. That is not what the report establishes. The reporter lists a remote MCP server, a plugin, a CLI and config changes, then states that the report “does not claim to establish data exfiltration”.
Treat the distinction as important. A silent install and a self-approved hook are serious consent failures on their own. Turning them into a data breach without packet captures, server logs or an admission weakens the case and gives Postman an easy rebuttal.
The disclosure gap is the stronger detail. Postman’s live download page now says: “The Postman app includes Postman CLI & Postman plugins, so you can use Postman from your terminal.” The Internet Archive copy from 26 October 2026 does not contain that sentence, two days after the first logged install, and the update flow wording is not public.
Why this fits a wider agent trust problem
This is the second consent problem in the coding agent stack in three days. On 1 November, the Cursor incident served a backdoored Claude Code extension for 11 hours. Postman’s case is not a compromise. It is a design choice, which makes it harder to dismiss as an accident.
Apple has moved the other way, tightening macOS Full Disk Access because agents can reach files users never meant to expose. That macOS change treats the agent as a principal with its own permission boundary. Postman’s installer treats it as a surface to configure on the user’s behalf.
Consent tokens are becoming the test. A desktop app that writes trust records into another vendor’s config is exactly the case a portable opt-out needs to cover.
What it means for Indian developers
Indian API teams are heavy Postman users, and many work on managed laptops with change control that covers installed software but not user-level agent config. This case sits in that gap: no admin install, no package manager entry, just new marketplace and hook entries in a home directory.
Three practical checks matter this week. First, diff ~/.codex/config.toml, ~/.claude/settings.json and ~/.copilot/settings.json against your known baseline. Second, list what is in ~/.local/bin and whether your endpoint tooling allows a Postman CLI that arrived outside your normal software channel.
Third, decide whether Postman belongs in your agent’s startup path. A team can keep using Postman for manual API work and still remove the plugin, the MCP entry and the hook. Add coding agent plugins to the software bill of materials, because a plugin that injects instructions into every session behaves like a build dependency, even when it lives in a dotfile.
How to check and remove it
Start with the Postman app menu, where the company says the CLI and plugins can be uninstalled. One user reports that this did not clear the Copilot entries, so verify each file afterwards.
For Codex, remove the [marketplaces.postman] block, the enabled postman@postman plugin and the hooks.state entry for the Postman session hook. Then restart Codex and confirm the hook no longer appears in hooks/list.
For Claude Code, remove postman@claude-plugins-official from ~/.claude/settings.json and the matching record from installed_plugins.json. For Copilot, remove the Postman marketplace and the enabledPlugins entry by hand if the in-app uninstall leaves them behind.
Finally, delete the Postman CLI from ~/.local/bin if you did not install it deliberately. Back up the config files before editing; they hold your other agent settings.
Frequently asked questions
Did Postman upload my API keys?
No evidence in the public report shows that. The reporter documented configuration changes and a failing MCP authentication attempt, and explicitly did not claim data exfiltration. Postman has not published an audit.
Which Postman versions are affected?
Reported installs involve desktop 12.33.4 and 12.35.1 on macOS. Postman has not published an affected version list, so any recent build with the bundled plugin service should be treated as potentially affected.
Does uninstalling Postman remove the plugins?
Not reliably, based on the reports. The app offers an uninstall entry, but one user says Copilot kept its Postman marketplace and enabled plugin. Check each agent’s config after any uninstall.
Is this legal?
That is a question for a lawyer. Consent rules differ by jurisdiction, and no regulator has announced a review. The factual dispute is narrower: whether the update flow gave existing users a clear choice.
What should a team do this week?
Inventory the three config files, remove anything nobody approved, and tell developers that opening a desktop API client can change their coding agent. If you need the agent features, install the plugin deliberately and review the hook yourself.
Sources
GitHub issue 14370, postmanlabs/postman-app-support, opened 25 October 2026, read 4 November 2026. https://github.com/postmanlabs/postman-app-support/issues/14370
Postman plugin repository, README and installer source at revision 6c8e452, read 4 November 2026. https://github.com/postmanlabs/postman-plugin
RuntimeWire, “Postman’s head of product says it will make AI agent plugin opt-in clearer after auto-install complaints”, 3 November 2026. https://runtimewire.com/article/postmans-head-of-product-says-it-will-make-ai-agent-plugin-o-7933b7
Postman download page, read 4 November 2026. https://www.postman.com/downloads/
Internet Archive copy of the Postman download page, 26 October 2026. https://web.archive.org/web/20261026090707/https://www.postman.com/downloads/
Hacker News discussion, 3 November 2026, 1,209 points and 394 comments at the time of reading on 4 November 2026. https://news.ycombinator.com/item?id=50354960