Postman Desktop Accused of Silently Installing Plugins Into Codex and Claude Code

The GitHub issue on Postman's public support tracker, opened on October 25, is titled "[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook." The reporter says that after they opened Postman desktop version 12.33.4 on a Mac, OpenAI's Codex began showing recurring Postman MCP authentication warnings and sending API work through Postman skills. A Postman log the reporter cites records an "auto-existing-upgrade" with results showing "claude-code:installed" and "codex:installed".

What Was Found on the Machine

The reporter lists a user-wide Postman plugin in Codex's configuration, a Claude Code plugin, a remote MCP server entry pointing to Postman's hosted endpoint and a separately installed Postman command-line tool. They also describe a startup hook that tells the agent to load a Postman "api-engineer" skill "before responding to any non-trivial API engineering task." The reporter argues that this goes well beyond what a user would expect from a Postman integration. They also cite installer code that "Approves only Postman's current hook after installation," meaning the installer appears to have marked its own hook as trusted.

The reporter asks Postman to treat the matter as a severe consent and security-boundary incident. They want automatic agent-plugin installation stopped for existing users until they explicitly opt in, installer-side hook approval removed, and a full rollback path provided. They also say the sequence has not yet been reproduced on a clean Mac.

The Data-Sharing Claim Is Disputed

The Hacker News post that spread the issue said Postman "attempts to share all API data." An analysis published on DEV Community on Tuesday disputes that part. Its author reviewed the plugin source and the reporter's logs and found that no API data was shown to leave the machine, because the remote MCP connection failed with an authentication error. The author still argued that installing plugins, connecting to a remote MCP server and writing a hook trust record are three separate consent decisions, and that the installer made all three in one silent run.

At the time of the reports, Postman had not replied publicly on the GitHub issue, and it was not clear which release or feature flag controls the upgrade path. At least one developer has since removed the Postman plugin from a shared configuration repository, citing the issue.

Why It Matters

Coding agents such as Codex and Claude Code now often have broad access to a developer's files, credentials and company systems. Plugins, hooks and MCP connections change what those agents do and which outside services they contact. Security teams generally treat changes to that layer as sensitive, much like browser extensions or package installs.

The Postman episode shows that the agent configuration on an engineer's laptop has become a new place where vendors can change behaviour without the user noticing. Companies that have deployed coding agents may want to check developer machines for unexpected plugins and hook approvals and set rules on which tools can modify agent settings. The reporter and the DEV analysis both suggest checking the Codex and Claude configuration files and local binary folders for Postman entries.