Postman's desktop app installed its own plugins into Claude Code and Codex

On 25 October 2026 a developer opened issue #14370 on Postman's support tracker under the title "SEVERE Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook". The report says that opening the Postman desktop app on a Mac was followed by changes to the developer's coding agents: Codex kept routing API work through Postman skills and showed recurring MCP authentication warnings.

The issue got its first reply on 2 November. On 3 November it was posted to Hacker News, where it passed 1,100 points, and the GitHub thread passed 30 comments. The same day, Postman's head of product, Sarabmeet Kallar, told RuntimeWire that the company will make the opt-in clearer, especially for existing users.

What the report found

The reporter ran Postman desktop 12.33.4. According to the issue, Postman's own log on that Mac, dated 24 October 2026, records an install with the source auto-existing-upgrade and the results claude-code:installed and codex:installed. The report lists what that run left behind:

• a user-wide Postman plugin and a Postman marketplace in Codex's global configuration;
• a startup instruction hook for Codex;
• a remote MCP connection to mcp.postman.com;
• a Postman plugin enabled in Claude Code's user settings;
• a Postman command-line tool in the user's home folder.

The remote MCP connection never worked on that machine. Codex logged "Auth required" when it tried to start the Postman server. The reporter is explicit that the report "does not claim to establish data exfiltration". The Hacker News title says the app "attempts to share all API data"; the issue itself does not show that.

The hook that tells the agent what to do

The startup hook is the part that changed how the agents behaved. The text it injects lives in Postman's public plugin repository and, on the current main branch, opens with "You have the Postman plugin." It then tells the agent: "Before responding to any non-trivial API engineering task — designing, implementing, mocking, testing, monitoring, documenting, or deploying an API or Postman Flow — load the postman:api-engineer skill and follow it." The same file says project instruction files such as AGENTS.md or CLAUDE.md take precedence over it.

The reporter argues that hook trust "must be decided by the user in the agent host". The issue points to the installer source, where a function in codex-hooks.ts carries the comment "Approves only Postman's current hook after installation" and writes a trusted hash for that hook into Codex's settings. The reporter found such a record on the affected Mac, but adds that it "does not prove who created that specific record".

Other developers saw the same thing

On 3 November a second user posted logs from a later build. Postman updated from 12.31.3 to 12.35.1 at launch, then the same auto-existing-upgrade source installed the CLI and the Claude Code and Codex plugins, and noted that Cursor already had the plugin. That user found no hook trust record in Codex's settings and wrote that they had no evidence data was uploaded.

Another commenter on the same thread found Postman entries in GitHub Copilot's settings file, and reported that the uninstall option inside Postman did not remove them from Copilot.

What Postman says

A reply posted on the issue at 23:36 UTC on 3 November, written in the company's name, says Postman bundles the CLI and agent plugins with the desktop app "because many users had trouble installing and wiring them up separately". It says this is mentioned on the download page and in the update flow, that each component can be removed from inside the app, and that Postman is "reviewing the hook approval and session-start behavior". FourWeekMBA notes that GitHub does not mark the account that posted it as a Postman member. The statement Kallar sent to RuntimeWire through Postman's press agency gives the same explanation.

The Postman download page now says "The Postman app includes Postman CLI & Postman plugins". A commenter on the issue linked a Wayback Machine copy of the page from 26 October and said that sentence was not there at the time.

What to check on your machine

If you have Postman desktop installed and use a coding agent, the files named in the issue are the places to look:

• ~/.codex/config.toml for a postman marketplace, a postman@postman plugin and any hooks.state entry for it;
• ~/.claude/settings.json and ~/.claude/plugins/installed_plugins.json for postman@claude-plugins-official;
• ~/.copilot/settings.json for a Postman marketplace or plugin;
• ~/.local/bin/postman for the CLI.

Commenters on the thread point to the app menu Help > Postman CLI and Plugins to uninstall the agent plugin, with the caveat above about Copilot.

Why it matters

Coding agents now read standing instructions from plugins, hooks and MCP servers. Whoever writes those files shapes what the agent does on the next task. This report shows one installed app writing them for agents it does not own, on an update the user did not configure. The fix Postman describes is a clearer opt-in. The issue's author asks for more: no automatic installs for existing users, and no installer approving its own hook.