Postman auto-installs Codex, Claude plugins without consent

What did Postman's desktop app do?

A developer identified as Indicava reported that opening Postman desktop on macOS triggered unexpected changes to their coding agents. Postman's own log at ~/Library/Application Support/Postman/logs/main.log recorded the event as 'auto-existing-upgrade,' with the installer script targeting both Codex and Claude Code.

The log entry read: 'PostmanAgentPluginService~install: script completed' with results showing 'claude-code:installed' and 'codex:installed.' The installer source confirms it explicitly attempts to pre-approve its own hooks, calling approvePostmanHook(system) after installation.

The issue affected Postman desktop version 12.33.4, with the Codex plugin at version 1.1.0 and the Claude plugin at version 2.0.1. The installed revision was pinned to commit 6c8e452e0f4237f4bcc0901cb1ac442dec707e49 of the postman-plugin repository.

What changes were made to Codex?

Postman's installer modified Codex's global user configuration at ~/.codex/config.toml, adding a Postman plugin marketplace entry pointing to the postman-plugin GitHub repository. It also wrote trusted_hash and trusted_content_hash values for a session-start hook that tells Codex to route API engineering tasks through Postman.

The installed hook, registered in hooks/codex-hooks.json, includes a SessionStart command that matches on startup|clear|compact. It prints context instructing the agent to load the postman:api-engineer skill for any non-trivial API task — a scope far broader than a user explicitly asking to use Postman.

Codex logs also showed repeated MCP authentication failures as the app attempted to connect to Postman's remote MCP server at https://mcp.postman.com/mcp, which requires authentication.

What about Claude Code?

Claude Code was also affected. Postman's installer modified ~/.claude/settings.json to enable the postman@claude-plugins-official plugin and recorded the installation in ~/.claude/plugins/installed_plugins.json with version 2.0.1, user scope, and timestamps matching the Codex installation window.

Additionally, a Postman CLI executable and its library directory were installed at ~/.local/bin, with modification times matching the same installation window.

How did the community react?

The GitHub issue quickly drew widespread condemnation. Comments on the thread described the behavior as 'malware-like,' with users comparing Postman to uTorrent — a once-respected tool that degraded trust through aggressive monetization and unwanted behavior.

The New Stack covered the incident, noting it revived questions about coding agent control and consent boundaries. The story also gained traction on Hacker News, accumulating over 1,300 points and hundreds of comments. Several users reported similar experiences with the auto-installation.

Postman's response on Discord was described by one user as dismissive, suggesting the company did not take the concerns seriously. At the time of writing, Postman has not issued a public statement addressing the specific findings.

The broader developer community has also raised concerns about the precedent this sets. If Postman can silently install hooks into AI coding agents, other tools may follow suit, leading to a race where every developer tool competes for influence over the same AI agent configurations. Without clear consent boundaries and audit trails, users have no way to know which tools have modified their agents or what those modifications do.

What did the reporter request from Postman?

The GitHub reporter requested that Postman treat this as a severe product consent and security-boundary incident, stop automatic agent-plugin installation for existing desktop users pending explicit opt-in, remove installer-side self-approval of hooks, and provide a complete rollback path covering agent configs, hook trust, MCP connections, and the CLI.

The reporter also asked Postman to narrow startup skill instructions to explicit Postman requests rather than making Postman the default for general API engineering. The installer source code suggests the auto-installation was intentional, with comments indicating the feature was designed to upgrade existing users without direct interaction.

What does this mean for AI agent security?

The Postman incident is the latest in a series of controversies around AI coding agent security. Earlier this year, researchers showed that a malicious AGENTS.md file in a user's Downloads folder could hijack Codex and Claude Code, and ProjectDiscovery demonstrated a backdoored model that could steal credentials through Codex CLI.

What makes the Postman case different is that the vector is not a malicious attack but an intentional product feature. The installer explicitly pre-approves its own hooks and adds a remote MCP connection — capabilities that, in the wrong hands or with a compromised update channel, could be exploited for far more damaging purposes.

The incident has prompted broader questions about the security model of AI developer tools. If a legitimate application like Postman can modify the configuration of Codex and Claude Code without user interaction, what prevents a compromised or malicious application from doing the same? The current trust model, where each coding agent independently trusts modifications made by other applications on the same machine, has no mechanism for user consent or audit.