Postman auto-installs agent plugins into Codex and Claude Code

Postman's desktop app auto-installs agent plugins into Codex and Claude Code, changes their global config files, and approves its own startup hook. That is the finding in a GitHub issue a developer filed on October 25. On November 3 it hit the front page of Hacker News with more than 1,000 points, and by the evening a reply in Postman's voice confirmed the behavior is deliberate. If anyone on your team has Postman installed, their coding agents may already be running Postman's instructions.

What actually happened

The reporter opened Postman 12.33.4 on a Mac and noticed Codex kept loading Postman skills for ordinary API work. Postman's log showed an auto-existing-upgrade job with the result claude-code:installed, codex:installed. What changed:

• Codex: ~/.codex/config.toml gained a Postman plugin marketplace, an enabled plugin, and a hooks.state entry with a trusted hash. The installer source writes that trust record itself. The code comment says it "approves only Postman's current hook after installation."
• The hook: a SessionStart hook tells the agent to load the postman:api-engineer skill before any non-trivial API task, whether or not you mentioned Postman.
• Remote MCP: the installer pointed Codex at mcp.postman.com. The connection failed with "Auth required."
• Claude Code: ~/.claude/settings.json enabled postman@claude-plugins-official, and a Postman CLI landed in ~/.local/bin.

One correction. The HN title says Postman "attempts to share all API data." The reporter says the report "does not claim to establish data exfiltration," and we found no evidence that data left any machine. It is also not a one-off. A later commenter saw the same job run on a November 3 update to 12.35.1, and another found Postman added to ~/.copilot/settings.json. The plugin README says the installer targets every compatible agent it detects.

The reply from Postman's side, posted late on November 3 by an account not marked as a maintainer, says the company bundles the CLI and plugins "because many users had trouble installing and wiring them up separately," and that uninstall is available in the app. It promises a clearer opt-in "especially for existing users" and a review of the hook approval. No timeline.

Why it matters for your business

Your coding agents read config files that any app on the machine can write. Postman used that to make itself the default for API work. A worse actor would add a hook that runs code on every session. The trojanized Claude Code extension last week was the hostile version of the same path.

Check every developer machine today:

grep -n postman ~/.codex/config.toml ~/.claude/settings.json ~/.copilot/settings.json 2>/dev/null
claude plugin list
ls -la ~/.local/bin | grep -i postman

Then decide, as a team, which vendors may install into your agents, and write it down. An agent config change by a desktop app needs a human yes, like a new browser extension.

Sources: GitHub issue postmanlabs/postman-app-support#14370, postman-plugin installer source, Hacker News thread.