Postman installed itself into Codex and Claude

Opening Postman on October 24 installed its plugin into two coding agents the user never asked it to touch — Codex and Claude Code — and the installer's own code then wrote the trust record for its own startup hook. No API data was shown to leave the machine: the remote MCP connection failed authentication, and the reporter explicitly does not claim exfiltration.

PostmanAgentPluginService~install: script completed {"source":"auto-existing-upgrade","results":["claude-code:installed","codex:installed"],"installer":"script"} Enter fullscreen mode Exit fullscreen mode The words that matter are auto-existing-upgrade. This was not a user clicking "install plugin." It was an upgrade path for an existing desktop user, firing on open, that reached into two unrelated tools.

I checked the plugin source myself at the exact revision the reporter pinned, 6c8e452e, rather than taking the issue's word for it. Three claims hold up verbatim:

2. The installer really does approve its own hook. installer/src/hosts/codex-hooks.ts exports approvePostmanHook, which queries Codex's hooks/list, reads the installed session-start file to confirm it is present, then calls config/batchWrite to upsert hooks.state with the hook's trusted_hash. The comment is candid: "Approves only Postman's current hook after installation." installer/src/hosts/codex.ts calls it right after installing the plugin. A hook trust decision is supposed to be the user's decision, in the host application. Here the vendor's installer makes it, for its own hook, in the same run that installed it.

3. The remote MCP endpoint is real, but it did not connect. mcp.codex.json at the same revision points at https://mcp.postman.com/mcp with the Codex plugin version 1.1.0. The reporter's Codex logs show the connection failing with "Auth required." So the honest statement is: a remote connection was configured, and it failed. Anyone writing "Postman shared all API data" from this issue is inventing the second half of the story.

The rest of the footprint matches the same pattern: Codex's global ~/.codex/config.toml gained a marketplaces.postman git source and an enabled postman@postman plugin; Claude Code's ~/.claude/settings.json enabled postman@claude-plugins-official at version 2.0.1, installed at the same October 24 timestamp; and a Postman executable appeared in ~/.local/bin.

Three caveats before anyone treats this as settled. First, this is a single reporter's machine, and the reporter is careful to say the sequence has not yet been reproduced on a clean Mac. Second, the issue page I read carried no maintainer reply, so Postman has not yet confirmed, denied, or scoped the auto-existing-upgrade path — including which release or feature flag gates it, and whether Cursor, OpenCode, or Pi installs are affected the same way. Third, the reporter's log shows a signed-in user, so whether a signed-out user would see the same behaviour is untested.

If you run Codex or Claude Code alongside Postman, the audit is quick: check ~/.codex/config.toml for a postman marketplace entry, ~/.claude/settings.json for the Postman plugin, your hook trust state for a Postman session-start entry, and ~/.local/bin for a Postman CLI you did not put there. Remove all four, and do not assume removing the desktop app removes the agent integrations — that is exactly the asymmetry this report exposes.

The fix the reporter asks for is the right shape, and it is narrow: stop automatic agent-plugin installation for existing desktop users pending explicit opt-in, remove installer-side hook self-approval entirely, and narrow the startup instruction to explicit Postman requests. Until Postman answers, treat any "just open the app" upgrade as a prompt to check what else changed.

Sources: postmanlabs/postman-app-support issue #14370 (reporter evidence, Postman 12.33.4, Codex plugin 1.1.0, Claude plugin 2.0.1, October 24–25, 2026) — https://github.com/postmanlabs/postman-app-support/issues/14370; postmanlabs/postman-plugin at revision 6c8e452e, files hooks/session-start-context.md, installer/src/hosts/codex-hooks.ts, installer/src/hosts/codex.ts, mcp.codex.json — https://github.com/postmanlabs/postman-plugin. The hook text, installer code path, and MCP endpoint above are from my own fetch of that pinned revision on November 3, 2026. The "no data shown to leave" and "not reproduced on a clean Mac" points are the reporter's own stated limits.