# Postman's desktop app quietly installed plugins into Codex and Claude Code. Here's how to check your machine

> A detailed bug report shows Postman 12.33.4 auto-installed its AI agent plugins into Codex and Claude Code for an existing user, added a startup hook that steers API work through Postman, and ran installer code that pre-approves that hook. Postman says it will make opt-in clearer. If you use Postman and a coding agent, check four files.

Published Nov 4, 2026 by TechMeasured Staff · Security · Canonical: https://techmeasured.com/security/postman-desktop-auto-installs-codex-claude-code-plugins-how-to-check

A developer has documented the **Postman desktop app** installing its own AI agent plugins into **OpenAI's Codex** and **Anthropic's Claude Code** without being asked. The report, filed on October 25 as issue **#14370** in Postman's public support repository, says this happened just from opening an existing install of **Postman 12.33.4** on a Mac. It reached the top of Hacker News on November 3, and by November 4 the issue had **38 comments**.

Why it matters: the plugin didn't just sit there. It added a **startup hook** that tells the coding agent to route most API work through Postman, plus a remote MCP connection and a command-line tool. Postman's installer code also **approves its own hook** in Codex, a step that's meant to be the user's decision. Agent config files are now a place where one app can quietly change how another app behaves.

## What the report shows

The reporter included Postman's own log entry, timestamped **October 24, 2026**. It records an install with the source `auto-existing-upgrade` and the results `claude-code:installed` and `codex:installed`. According to the issue, the changes were:

| Where | What was added |
|---|---|
| `~/.codex/config.toml` | A Postman plugin marketplace (git source), the `postman@postman` plugin enabled, and a trust record for Postman's session-start hook |
| Codex plugin hook | A `SessionStart` hook that tells the agent to load the `postman:api-engineer` skill before any non-trivial API task |
| Codex MCP config | A remote server at `mcp.postman.com`; it failed with an "Auth required" error |
| `~/.claude/settings.json` | `postman@claude-plugins-official` enabled at user scope (plugin version 2.0.1) |
| `~/.local/bin` | A Postman CLI executable and its `lib` directory |

The hook's instruction covers designing, implementing, mocking, testing, monitoring, documenting or deploying an API. The reporter says that's why Codex kept announcing Postman skills on ordinary API tasks.

On the hook approval, the issue cites Postman's open-source plugin repo. There, `installer/src/hosts/codex.ts` calls an `approvePostmanHook` function after installing, and `codex-hooks.ts` writes a `trusted_hash` for the hook into Codex's config. We confirmed that both files contain that function via GitHub code search. The reporter is careful to say the trust record alone doesn't prove which process wrote it on their machine.

## What it does *not* show

The Hacker News headline claimed Postman "attempts to share all API data." The report doesn't say that. It explicitly says it shows unwanted integration and instruction changes and **does not establish data exfiltration**. The remote MCP connection never authenticated. The reporter also notes the sequence hasn't been reproduced on a clean Mac, and it involved a signed-in user.

## Postman's response

Postman's head of product, Sarabmeet Kallar, told RuntimeWire on November 3 that the company will make opt-in for its agent plugins clearer, "especially for existing users." He said Postman bundles the CLI and plugins to ease setup and is reviewing the hook approval and session-start behavior. As of the write-ups we read, Postman hadn't replied in the GitHub thread, and it hasn't said which release or feature flag triggered `auto-existing-upgrade`. It also hasn't said whether other agents besides Codex and Claude Code can be affected.

## What to do

If you have the Postman desktop app and use Codex or Claude Code, check these locations. Remove anything you didn't choose to install.

```bash
# Codex: marketplace, plugin and hook trust entries
grep -n -i postman ~/.codex/config.toml

# Claude Code: enabled plugins and install records
grep -n -i postman ~/.claude/settings.json ~/.claude/plugins/installed_plugins.json

# Stray CLI
ls -la ~/.local/bin | grep -i postman
```

- **Delete the `[marketplaces.postman]`, `[plugins."postman@postman"]` and Postman `hooks.state` blocks** from `~/.codex/config.toml` if you didn't add them.
- **Disable or remove the Postman plugin in Claude Code** if it shows up in `enabledPlugins`.
- **Don't assume uninstalling Postman cleans up.** A DEV Community write-up warns that removing the desktop app may leave these integrations behind. Check the files yourself.
- **Teams:** if you manage developer laptops, add these paths to config-drift checks. Treat any change to agent hooks or trust records the way you'd treat a new browser extension.

## What to watch

The reporter asked Postman to stop auto-installing for existing users, drop installer-side hook approval, and publish a full rollback path. Kallar's statement points to clearer opt-in. It doesn't commit to removing the self-approval step. The next desktop release notes should show whether that changed.


## Sources

1. [GitHub — postmanlabs/postman-app-support #14370: Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook](https://github.com/postmanlabs/postman-app-support/issues/14370)
2. [RuntimeWire — Postman's head of product says it will make AI agent plugin opt-in clearer after auto-install complaints](https://runtimewire.com/article/postmans-head-of-product-says-it-will-make-ai-agent-plugin-o-7933b7)
3. [Aivy — Postman quietly installed itself into Claude Code and Codex](https://aivy.com.au/news/postman-claude-code-codex-plugin/)
4. [DEV Community — Postman installed itself into Codex and Claude](https://dev.to/frankchu/postman-installed-itself-into-codex-and-claude-e38)
5. [daily.dev — Postman silently auto-installs AI plugins and attempts to share all API data](https://daily.dev/posts/postman-silently-auto-installs-ai-plugins-and-attempts-to-share-all-api-data-9wqvbcblh)