Postman Desktop Reportedly Installed Coding Agent Plugins Without Permission

A developer known as indicava on GitHub reported that opening Postman desktop version 12.33.4 on macOS triggered plugin installations for Claude Code and OpenAI Codex without explicit permission. The October 25 report also says Postman's installer approved a trusted session-start hook in Codex, which tells the agent to use Postman tools for API development tasks. Postman had not responded to The New Stack's questions by publication time.

What the report describes

According to the report, Postman application logs included in the GitHub issue show an installation event on October 24 marked auto-existing-upgrade. Results indicated plugins for both coding agents had been installed. The developer found changes to Codex's user-level configuration file, ~/.codex/config.toml, including an enabled Postman plugin, a new plugin marketplace, and a trusted session-start hook. Claude Code's configuration also showed an installed Postman plugin. A Postman CLI executable was found with timestamps matching the installation. The developer says they had not explicitly authorized these changes. The report documents one macOS installation and has not been independently reproduced across other systems.

How the startup hook was approved

Postman documentation says its installer can automatically approve a session-start hook on the user's behalf. Developers who install the plugin directly through Codex must review and approve the hook themselves. Installer source code shows Postman checks whether Codex already trusts the hook. If it does not, the installer uses config/batchWrite to add the hook's trusted hash to Codex's configuration. It checks that the hook has not changed before approving it. If approval fails or cannot be confirmed, it logs a message telling the developer to review the hook in Codex. Session-start hooks can give coding agents instructions automatically. Postman's startup instructions tell Codex to load the postman:api-engineer skill before handling most API development tasks. Codex is still supposed to follow the developer's instructions first, but for many API tasks it is also told to use Postman's tools by default.

Security reactions and open questions

The findings drew criticism from developers on GitHub and X. Security researcher Frank Denis called the integrations junk on X and pointed out that Postman's installer attempts to trust its own startup hook. Siddharth Garimella claimed Postman's hooks intercept API data and send it back to the company, but the GitHub report provides no evidence that Postman collected or transmitted API data. It documents changes to agent settings and a remote MCP connection, not data theft. A GitHub commenter called the behavior unacceptable, even creating risk in corporate environments. Another urged Postman to be transparent and ask for permission. The developer also found that Postman configured a connection to its remote MCP server at https://mcp.postman.com/mcp, but Codex repeatedly failed to authenticate. The developer wants Postman to stop installing plugins for existing users without permission, leave hook approval to Codex, and provide a way to fully undo changes. Postman provides an uninstall command, but the developer says removing the integration should also clear changes to agent settings, trusted hooks, MCP connections, and installed CLI tools. Developers can check Claude Code and Codex settings for unfamiliar plugins, hooks, or MCP connections. What remains unanswered is why an existing desktop installation reportedly triggered that process without user permission.

Sources: The New Stack