Postman's desktop app quietly installed plugins into Codex and Claude Code. Here's how to check your machine

A developer has documented the Postman desktop app installing its own AI agent plugins into OpenAI's Codex and Anthropic's Claude Code without being asked. The report, filed on October 25 as issue #14370 in Postman's public support repository, says this happened just from opening an existing install of Postman 12.33.4 on a Mac. It reached the top of Hacker News on November 3, and by November 4 the issue had 38 comments.

Why it matters: the plugin didn't just sit there. It added a startup hook that tells the coding agent to route most API work through Postman, plus a remote MCP connection and a command-line tool. Postman's installer code also approves its own hook in Codex, a step that's meant to be the user's decision. Agent config files are now a place where one app can quietly change how another app behaves.

What the report shows

The reporter included Postman's own log entry, timestamped October 24, 2026. It records an install with the source auto-existing-upgrade and the results claude-code:installed and codex:installed. According to the issue, the changes were:

The hook's instruction covers designing, implementing, mocking, testing, monitoring, documenting or deploying an API. The reporter says that's why Codex kept announcing Postman skills on ordinary API tasks.

On the hook approval, the issue cites Postman's open-source plugin repo. There, installer/src/hosts/codex.ts calls an approvePostmanHook function after installing, and codex-hooks.ts writes a trusted_hash for the hook into Codex's config. We confirmed that both files contain that function via GitHub code search. The reporter is careful to say the trust record alone doesn't prove which process wrote it on their machine.

What it does not show

The Hacker News headline claimed Postman "attempts to share all API data." The report doesn't say that. It explicitly says it shows unwanted integration and instruction changes and does not establish data exfiltration. The remote MCP connection never authenticated. The reporter also notes the sequence hasn't been reproduced on a clean Mac, and it involved a signed-in user.

Postman's response

Postman's head of product, Sarabmeet Kallar, told RuntimeWire on November 3 that the company will make opt-in for its agent plugins clearer, "especially for existing users." He said Postman bundles the CLI and plugins to ease setup and is reviewing the hook approval and session-start behavior. As of the write-ups we read, Postman hadn't replied in the GitHub thread, and it hasn't said which release or feature flag triggered auto-existing-upgrade. It also hasn't said whether other agents besides Codex and Claude Code can be affected.

What to do

If you have the Postman desktop app and use Codex or Claude Code, check these locations. Remove anything you didn't choose to install.

# Codex: marketplace, plugin and hook trust entries
grep -n -i postman ~/.codex/config.toml

# Claude Code: enabled plugins and install records
grep -n -i postman ~/.claude/settings.json ~/.claude/plugins/installed_plugins.json

# Stray CLI
ls -la ~/.local/bin | grep -i postman

• Delete the [marketplaces.postman], [plugins."postman@postman"] and Postman hooks.state blocks from ~/.codex/config.toml if you didn't add them.
• Disable or remove the Postman plugin in Claude Code if it shows up in enabledPlugins.
• Don't assume uninstalling Postman cleans up. A DEV Community write-up warns that removing the desktop app may leave these integrations behind. Check the files yourself.
• Teams: if you manage developer laptops, add these paths to config-drift checks. Treat any change to agent hooks or trust records the way you'd treat a new browser extension.

What to watch

The reporter asked Postman to stop auto-installing for existing users, drop installer-side hook approval, and publish a full rollback path. Kallar's statement points to clearer opt-in. It doesn't commit to removing the self-approval step. The next desktop release notes should show whether that changed.