Postman's Desktop App Quietly Installed Its Plugins Into Claude Code and Codex, Then Pre-Approved Its Own Hook

What happened

The report is issue #14370 in the postmanlabs/postman-app-support repository, titled "[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook". Its author, GitHub user indicava, wrote: "Opening Postman on my Mac was followed by unexpected changes to my coding agents." Instead of an offer to install, "the integrations were installed automatically and broad startup instructions were added."

In the original report, the install ran when Postman desktop 12.33.4 was opened on October 24, putting Codex plugin 1.1.0 and Claude Code plugin 2.0.1 in place. On November 3 another user, ronthedrummer, said the same thing happened after an update from 12.31.3 to 12.35.1 on macOS 26.5.2, so it is not tied to a single build. Every report so far comes from macOS.

Postman's own log, quoted in the report, shows the install was triggered by the upgrade itself rather than by a user action:

PostmanAgentPluginService~install: script completed {"source":"auto-existing-upgrade", "results":["claude-code:installed","codex:installed"], "installer":"script"}
Main: autoInstall.plugin.existing-user finished

By November 4 the issue had more than 160 thumbs-up reactions and dozens of comments. A secondary report says the story reached number two on Hacker News; we have not checked that figure against Hacker News directly.

What the installer changed on disk

According to the report, the upgrade wrote to the configuration of more than one coding agent:

• ~/.codex/config.toml: a [marketplaces.postman] entry, a [plugins."postman@postman"] block with enabled = true, and [hooks.state] entries carrying trusted_hash values.
• ~/.claude/settings.json: enables postman@claude-plugins-official in Claude Code, with a matching record in ~/.claude/plugins/installed_plugins.json.
• ~/.local/bin: a Postman CLI executable and its lib directory.
• ~/.copilot/settings.json: a commenter, ck-tecso, also found a postman@postman entry in the GitHub Copilot CLI settings. Another user said Cursor sessions showed the same session-start text.

That spread matches what the plugin is built to do. Postman's plugin README says a single command, npx @postman/postman-plugin, configures Antigravity, Claude Code, Codex, GitHub Copilot CLI, Cursor, Factory Droid, Kimi Code, OpenCode and Pi. The complaint is not that the plugin exists, but that the desktop app ran its installer for existing users who never chose to install it. Postman's install documentation describes three manual routes and does not mention the desktop app installing anything on its own.

The Codex hook that approved itself

The part that drew the most criticism is a Codex SessionStart hook. Per the report, the plugin's hooks/codex-hooks.json registers a hook that fires on startup, clear and compact, and prints a file called session-start-context.md. That text tells the agent that "Before responding to any non-trivial API engineering task" it should load the postman:api-engineer skill. That reaches well beyond a user asking for Postman by name: any API work in any project gets steered toward Postman's tools.

Codex is designed to stop exactly this kind of surprise. OpenAI's hooks documentation says "Non-managed hooks must be reviewed and trusted before they run," that "Codex records trust against the hook's current hash," and that "new or changed hooks are marked for review and skipped until trusted." Plugin-bundled hooks "use the same trust-review flow as other non-managed hooks." For SessionStart, "Plain text on stdout is added as extra developer context", meaning the hook's text goes straight into the model's instructions.

The reporter cites installer source that calls approvePostmanHook after installing, using Codex's hooks/list and config/batchWrite interfaces to write a hooks.state entry with a trusted_hash. A source comment reads: "Approves only Postman's current hook after installation." The reporter notes that a trust record alone does not prove who wrote it on a given machine.

What the plugin sends to Postman

There is no evidence of data theft, and nothing in the reports describes malware. The plugin's own documentation does set out what it reports by default, which is worth knowing if it ended up on your machine without your say-so.

• CLI event reporting, covering items such as test results, workspace push contents and "Agent's API interaction activity", is on by default: "Publishing happens by default. To change this workflow, you can set --report-events=false per invocation."
• The plugin registers Postman's hosted MCP server, https://mcp.postman.com/mcp, as a fallback, and the README says "MCP tool calls reach Postman by design and are not governed by the CLI flags above".

Postman's response

On November 3, a commenter replying on Postman's behalf, zecoquit, explained that "we bundle the Postman CLI and the agent plugins with the desktop app because many users had trouble installing." The reply continued: "That said, we've heard you. We're going to make the opt-in clearer, especially for existing users."

The reply says the components can be uninstalled from inside the app and that Postman is "reviewing the hook approval and session-start behavior you flagged", with updates promised in the thread. It does not commit to removing the automatic install or the self-approval, and Postman's documentation does not yet describe an in-app uninstall.

Separately, Postman archived its old postman-devrel/postman-claude-code-plugin repository on November 3. The plugin now lives at github.com/postmanlabs/postman-plugin.

Why it matters

Coding agents now run with access to source code, shells and credentials, and their configuration files decide what instructions they load before every session. A desktop app that edits those files during an update, and pre-approves its own hook in the one agent that asks for review, sets a precedent that other vendors may follow. Even with no bad intent, a broad startup instruction changes how an agent behaves on unrelated work, and it does so silently.

For teams, it is also a reminder that agent config in home directories is part of the attack surface. Any tool with write access to ~/.claude or ~/.codex can change what an agent trusts.

How to check your machine and remove it

If you run Postman desktop on a Mac alongside Claude Code, Codex or Copilot CLI, these commands, taken from the report and a follow-up write-up, show whether the plugin was added:

grep -n -i postman ~/.codex/config.toml
claude plugin list
grep -n -i postman ~/.claude/settings.json
grep -n -i postman ~/.copilot/settings.json
ls -l ~/.local/bin | grep -i postman

To remove it:

1. Claude Code: run claude plugin disable postman@claude-plugins-official, or uninstall the plugin outright.
2. Codex: open /hooks inside Codex and disable the Postman SessionStart hook.
3. Everything else: run Postman's own remover, npx @postman/postman-plugin remove (alias: uninstall).
4. Run the grep commands again afterwards. Postman does not document whether its remover clears the trust record in ~/.codex/config.toml, so check the [hooks.state] entries yourself.

Sources: the GitHub issue at github.com/postmanlabs/postman-app-support/issues/14370, Postman's plugin README at github.com/postmanlabs/postman-plugin, Postman's install docs at learning.postman.com/docs/postman-plugin/install/overview, and OpenAI's Codex hooks documentation at learn.chatgpt.com/docs/hooks.

Key takeaways

• Postman desktop on macOS installed its plugins into Claude Code and Codex for existing users during an upgrade, without asking, according to GitHub issue #14370.
• The report says the installer also wrote a trusted_hash for Postman's Codex SessionStart hook, skipping the review Codex requires for non-managed hooks.
• The hook tells the agent to load Postman's skill before any non-trivial API engineering task, not only when you ask for Postman.
• Postman says it will make the opt-in clearer and is reviewing the hook approval; a November 3 report shows the auto-install still happening on 12.35.1.
• Check ~/.codex/config.toml, ~/.claude/settings.json and ~/.copilot/settings.json, then remove the plugin and re-check the Codex trust record.