Postman desktop auto-installed plugins into Claude Code and Codex

A developer opened Postman on their Mac and their coding agents started acting differently, and the reason turned out to be a plugin Postman installed into Claude Code and Codex on its own.

The report is issue #14370 on Postman's GitHub tracker, opened on October 25, 2026 under the title "[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook". The reporter noticed recurring MCP auth warnings and Codex routing API work through Postman skills they never asked for. So they went digging and found a user-wide Postman plugin, a startup hook, a remote MCP connection, a Claude Code plugin and a Postman CLI they hadn't installed.

The Hacker News post about it reached 1343 points and 453 comments. The HN title says Postman "attempts to share all API data", which is a stronger claim than the issue makes, so more on that below.

What's actually new

Postman's own log is the core evidence. On 2026-10-24, Postman desktop 12.33.4 recorded a script install with the source auto-existing-upgrade and the results claude-code:installed and codex:installed. That's an install pushed to an existing desktop user who just opened the app.

Here's what it changed, per the issue:

• Codex. ~/.codex/config.toml got a Postman marketplace, the postman@postman plugin set to enabled, and a trusted_hash under hooks.state for the plugin's session-start hook.
• The hook. It fires on startup|clear|compact and prints an instruction: "Before responding to any non-trivial API engineering task", load the postman:api-engineer skill and follow it. That's every session, whether you mentioned Postman or not.
• Claude Code. ~/.claude/settings.json enabled postman@claude-plugins-official at user scope, version 2.0.1.
• MCP. A remote server at https://mcp.postman.com/mcp, which failed to start with "Auth required".
• CLI. A Postman executable in ~/.local/bin.

The part that got the SEVERE label is the trust record. Codex asks you to review and trust a hook before it runs. Postman's installer calls a function named approvePostmanHook, which writes that trust itself. This was deliberate btw. PR #124 in the postman-plugin repo, merged on October 21, added the auto-approval, and its description says "Hooks can run outside the sandbox." GitHub's automated Copilot review on that PR flagged it: "Automatically granting persistent trust to hooks that can execute outside the sandbox warrants human security review." It got merged anyway. The plugin README says it too: "There is no separate hook prompt or dump of its instructions."

The reporter is careful about the limits. They say the code shows the approval attempt, not proof of who wrote the record on their machine, that they haven't reproduced it on a clean Mac, and that the report "does not claim to establish data exfiltration."

About that data-sharing headline

The issue never says Postman shares all your API data. The closest thing is in the plugin README. Once a folder is connected to a Postman workspace with postman init, commands publish their artifacts to that workspace by default, and postman request publishes the "Agent's API interaction activity". The off switch is --report-events=false, set per command. The hosted MCP fallback is separate, and the README says its tool calls "reach Postman by design" and aren't covered by that flag.

So publishing by default is real, but it starts after a workspace link, and nothing in the report shows data leaving the reporter's laptop.

Why it matters if you build agents

Your agent's config is an install target now. ~/.codex/config.toml and ~/.claude/settings.json decide which MCP servers load, what instructions the agent reads before your first prompt and what runs as you. Any app with an installer and access to your home folder can write to them, and Postman's installer already supports nine agents.

Say you ask Codex to add a retry to your webhook handler. With that hook in place your agent has been told to load a vendor's skill first, for a task that has nothing to do with the vendor. Nobody types anything malicious. The instruction is just sitting there at session start.

One habit that helps imo is keeping that config short enough to read at a glance. If your agent reaches its apps through one gateway entry, like the single [mcp_servers.mewcp] table you add to config.toml in MewCP's Codex setup, then a new server entry you didn't add stands out right away. MewCP also lets you choose which tools each agent can use and stops anything switched off before it reaches the app, and every call is logged so you can see what ran. To be clear, it does nothing about a desktop app writing hooks or plugins into your files. Those run locally, so you still have to watch the files yourself.

What people are saying

The GitHub thread is mostly anger, with commenters calling it malware and spyware, a few saying they'd uninstalled it and others pointing to Bruno or Insomnia instead. The useful bits are reports from other machines. One commenter found Postman entries in their Copilot settings too, and said the in-app uninstall option didn't remove it from Copilot. Another said a desktop update wrote the CLI, the Claude Code plugin and the Codex entries on their machine but they found no trusted_hash, on an older Codex build.

Commenters on Hacker News mostly went somewhere else. The top thread was about Postman itself, with one commenter saying it raised over $400M and hired 1,500+ people for what should have been a small tool like curl. The rest is a long argument about venture money and open source licenses.

Open questions

• Postman's response. One write-up quotes a November 3 reply in the thread, in Postman's voice, saying it will "make the opt-in clearer, especially for existing users" and is "reviewing the hook approval and session-start behavior". It also notes the account lists no company. AI Weekly said Postman hadn't publicly responded, and Sesame Disk found no postmanlabs staff reply in the comments it could read on November 3. Treat it as unconfirmed until it shows up in Postman's own release notes.
• Which releases. No changelog ties auto-existing-upgrade to a release or a feature flag yet.
• Clean removal. The README lists npx @postman/postman-plugin remove, but nobody in the sources confirms it clears the Codex trust record.

If you have Postman installed, grep ~/.codex/config.toml and ~/.claude/settings.json for postman, run /hooks in a Codex session to review or disable the hook, and check ~/.local/bin. Then read the files again after removal, because removal doesn't always stick.

Sources

• [SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook, issue #14370, https://github.com/postmanlabs/postman-app-support/issues/14370
• postman-plugin PR #124, feat(installer): auto-approve Postman's Codex hook, https://github.com/postmanlabs/postman-plugin/pull/124
• postman-plugin README, https://github.com/postmanlabs/postman-plugin
• Hacker News discussion, https://news.ycombinator.com/item?id=50354960
• dev.to, Postman Desktop Added Itself to Claude Code and Codex, https://dev.to/gabrielanhaia/postman-desktop-added-itself-to-claude-code-and-codex-its-installer-trusts-its-own-hook-2oga
• AI Weekly, Postman Desktop Silently Installs Plugins Into Codex, Claude Code, https://aiweekly.co/alerts/postman-desktop-silently-installs-plugins-into-codex-claude-code
• Sesame Disk, Postman Silently Auto-Installs AI Plugins, https://sesamedisk.com/postman-silently-auto-installs-ai-plugins/
• MewCP docs, How to Connect Codex to MewCP, https://docs.mewcp.com/mewcp/connect-agents/codex.md