Postman's desktop application silently installed plugins into Claude Code and OpenAI Codex on a developer's machine without explicit authorization, modifying both agents' configurations and attempting to approve its own startup hook, according to a GitHub report and follow-up coverage.
A developer identified as indicava on GitHub reported on October 25 that opening Postman desktop version 12.33.4 on macOS triggered an installation process affecting both Claude Code and Codex2. The developer said Codex then began showing authentication errors and repeatedly loading Postman skills without being asked.
What the logs show
Postman's application logs, included in the GitHub issue, recorded an installation event on October 24 marked "auto-existing-upgrade," with results indicating that plugins for both coding agents had been installed. The developer found changes to Codex's user-level configuration file, ~/.codex/config.toml, including an enabled Postman plugin, a new plugin marketplace entry, and a trusted session-start hook. Claude Code's configuration similarly showed an installed Postman plugin. A Postman CLI executable was also found on the machine, with timestamps matching the installation.
Postman's startup instructions tell Codex to load a postman:api-engineer skill before handling most API development tasks. Postman's own documentation states that its installer can automatically approve a session-start hook on the user's behalf. The installer checks whether Codex already trusts the hook and, if not, uses config/batchWrite to add the hook's trusted hash to Codex's configuration. By contrast, developers who install the plugin directly through Codex must review and approve the hook themselves.
Scope and disputed claims
The report documented changes to agent settings and a remote MCP connection to https://mcp.postman.com/mcp, but provided no evidence that Postman collected or transmitted API data. The behavior was documented on one macOS installation and had not been independently reproduced across other systems as of the report.
The GitHub issue drew significant attention, accumulating 626 points and 202 comments on Hacker News1. Security researcher Frank Denis called the integrations junk on X and said Postman's installer attempts to trust its own startup hook. A separate commenter, Siddharth Garimella, claimed that Postman's hooks intercept API data and send it back to the company, though the original report did not document data exfiltration.
The developer said Postman provides an uninstall command but called it insufficient, requesting a way to fully undo the changes to agent settings, trusted hooks, MCP connections, and installed CLI tools. The developer also asked Postman to stop installing plugins for existing users without permission and to leave hook approval to Codex.
ANALYSIS The incident exposes a gap in how AI coding agents handle third-party plugin installation: Postman's desktop app was able to write directly to agent configuration files and approve its own trusted hook, bypassing the manual review that a direct Codex plugin install would require. No packet source records a response from Postman.