What did the Postman agent plugin report claim?

A user filed GitHub issue 14370 on October 25, 2026, saying that on one Mac the Postman desktop app 12.33.4 installed Postman's plugins into Codex and Claude Code without being asked, and that the installer approved its own Codex session-start hook. The reporter says it was not yet reproduced on a clean Mac and does not claim data was stolen. Postman's maintainers had not replied in the issue at our November 3, 2026 review.

Does Postman's own code approve its Codex hook?

Yes, per Postman's public plugin repository: an installer function writes a trusted hash for Postman's own session-start hook, a change merged on October 21, 2026. Postman's README and documentation also say that installing for Codex approves the hook. Whether the desktop app triggers that install by itself is what the report alleges, and we found no Postman confirmation.

Was API data sent to Postman?

The reporter does not claim so and says a connection to the hosted MCP server failed with an authentication error on their machine. Nothing we read shows data leaving a machine because of this install. Postman's README documents separate data paths: some command-line results are published to a connected workspace by default, with a per-command off switch, and the hosted MCP server is a different connection. One authentication failure on one machine is not an audit of what leaves a computer.

What is a session-start hook in an AI agent?

A command that the agent runs at the start of a session, whose output is added to the agent's context before the user asks anything. In Postman's case the command prints text telling Codex to load a skill for API work, and the text states that user instructions take precedence. Postman's own pull request notes that hooks can run outside the sandbox.

How can a team control plugins and hooks on agents?

Our recommendation, not Postman's: keep an inventory of plugins, hooks and MCP servers per machine, pin approved versions, require approval inside the agent for each integration, and alert on changes to the agent's configuration files.

Postman Auto-Install Report: Codex & Claude Code

Four slots on a dark panel: three hold white blocks and a fourth outlined in red slides in along a red beam, under an open gate frame

The short version

Short answer: not proven. One user reports that Postman's desktop app installed its plugins into Codex and Claude Code on their Mac without asking. Postman's own code does show its installer approving Postman's own startup instruction for Codex. The reporter does not claim data was taken, Postman's maintainers had not replied at our November 3 review, and we tested nothing. Why it matters: a friendly tool can change what your agents are told, so ask who is allowed to.

In plain words

Postman is a very common program that developers use to build and test the connections between business systems. Codex and Claude Code are AI assistants that write and run code on a developer's computer, the kind your contractors or IT team may already use. The report says Postman's app added itself to those assistants, with its own standing instructions.

Why it can matter to you: if anyone working for you uses AI coding assistants, other programs on their laptop may be quietly changing what those assistants are told to do. This article separates what is proven from what is only claimed, and lists what to ask your team.

Basis: one public bug report plus Postman's own plugin code and documentation, read on November 3, 2026. We tested nothing. Findings are attributed to their source, and our recommendations are marked as ours. Two terms you will meet: a hook is a small program an agent runs automatically before you type anything, a standing order slipped into its briefing; an MCP server is a remote service an agent can call, like a socket for plug-ins. If you commission or run AI agents rather than write code, the reason to read on is a pattern: a trusted desktop tool can change how the agents on the same machine are configured, and who is allowed to do that is a permission question, not a detail of the installer.

Did Postman Desktop Auto-Install Codex and Claude Code Plugins?

The report is GitHub issue 14370 in Postman's public support repository, titled "[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook". It was opened on October 25, 2026 by an outside user, not by Postman staff, and was still open at our November 3 review, with comments from other users and no reply from Postman's maintainers. The report was also posted on Hacker News on November 3, more than a week after the issue was opened, and had several hundred points when we read it. The Hacker News title says the app "attempts to share all API data". The issue itself does not say that: the reporter writes that the report does not claim to establish data exfiltration.

The reporter's evidence, in their own words and from one Mac: Postman desktop 12.33.4, a line in Postman's local log dated October 24 that records a source called "auto-existing-upgrade" and shows both the Codex and Claude Code plugins as installed, and entries in the Codex configuration file for a Postman marketplace, an enabled Postman plugin and a trusted hash for a session-start hook. The reporter says they could not yet reproduce it on a clean Mac and that a connection to Postman's hosted MCP server failed with an authentication error. We cannot check the log or the file ourselves; we only have what the reporter quotes.

Does Postman's Plugin Installer Auto-Approve Codex Hooks?

This part we read directly in Postman's public plugin repository and documentation. The installer contains a function named approvePostmanHook. In the source it asks Codex for its list of hooks, checks that Postman's hook is marked untrusted or modified, and then writes that hook's hash into Codex's trusted state. In the source, a failure in this step is logged and the install still completes, so "attempts to approve" is the accurate description, not "always approves". A pull request titled "auto-approve Postman's Codex hook", authored by a Postman organization member, was merged on October 21, 2026, three days before the log line the reporter quotes. The description includes the sentence "Hooks can run outside the sandbox." The pull request does not state why the design was chosen, and we do not attribute a motive.

The hook is a command, not just a text file. In the version we read, Postman's Codex plugin registers a SessionStart command for the startup, clear and compact events, and the script it runs prints a Markdown instruction file into the agent's context. That file tells the agent to load Postman's api-engineer skill first for any non-trivial API task, such as design, implementation, mocking, testing, monitoring, documentation or deployment. The same file says user instructions and project files take precedence over that mandate, which the report does not quote. Postman's README and its "detected agents" documentation both say that installing for Codex approves the hook, with no separate prompt; if Codex's hook interface is not available, the installer asks the user to approve it inside Codex. The documentation also says that if you install for Codex with its own method, you review and approve the hook yourself. So the self-approval applies to Postman's multi-agent installer; whether the desktop app follows that path is the reported part, and the documentation does not establish it.

What the documentation does not say matters here. The plugin pages present installation as something the user does: a command such as the package's installer, or each agent's own method. The pages we read do not mention the desktop app installing the plugin by itself, or any way to opt out of that. The desktop installation page says the Postman CLI is installed with the app and says nothing about agent plugins; Postman's downloads page says the app "includes Postman CLI & Postman plugins", which fits the reporter's account but does not show that the app installs them into other agents by itself. A bundled Postman CLI on the reporter's machine is therefore not, by itself, evidence of an unexpected plugin install; the disputed part is the reported installation and configuration of plugins inside other coding agents.

Postman Auto-Install: Confirmed Facts vs. Unverified Claims

Claim	Status on November 3, 2026	Source
Postman's installer approves Postman's own Codex hook	Confirmed: in the installer source, the README and the docs; the change was merged October 21	Postman plugin repository and docs
The desktop app installed both plugins on the reporter's Mac without being asked	Reported: one log line on one machine, not reproduced on a clean Mac, not confirmed by Postman	Issue 14370
API data was sent to Postman because of this	Not claimed by the reporter and not shown	Issue 14370
Which versions, platforms and how many users are affected	Unknown; the 12.33 release notes could not be read	None found
Postman's explanation, a fix or a rollback	None found as of our November 3 review	Issue, Hacker News thread, plugin repository

Postman did publish a new plugin package version, 0.6.0, on November 3. We found nothing that ties it to the report.

What Does Postman's Codex Session-Start Hook Do?

An agent does what its instructions say, and a hook is a command that runs at the start of a session and feeds instructions to the agent before the user types anything. Most people never read it. In this case the text we read is limited to API work and says the user's instructions come first, which is a sensible guard. The point for buyers is that the channel exists and that a program other than the user's agent can approve it. Postman's own pull request says hooks can run outside the sandbox, so a hook deserves the review you would give any code that runs with the user's rights.

What is the lesson for people who build or buy agents?

These are our reading and recommendations, not Postman's or the reporter's. The report is a small, concrete example of a bigger question: who may change what an agent is told and what it can call.

Treat anything that can write to an agent's configuration as part of its attack surface. That includes friendly desktop apps, installers and extensions. Ask who is allowed to add a plugin, a hook or a remote MCP server to an agent on a developer machine, and whether that is the user or another program.
Opt-in versus opt-out is a permission decision. If your product moves into someone else's agent, ask permission inside that agent, one integration at a time, and do not quietly reinstall what the user removed.
Review hooks like code. A broad "use this skill first" line changes behaviour in every session even when it says user instructions win.
Write down every data path separately. Postman's README says certain command-line results are published to a connected workspace by default, with a per-command off switch. Its hosted MCP server is a different connection, and the README tells you to skip it if you do not want that path. The reporter's authentication failure on that server is one machine's result, neither evidence of exfiltration nor an audit of outbound traffic.
Keep an inventory. List the plugins, hooks and MCP servers on every machine where an agent runs, pin approved versions, and alert on changes to the agent's configuration files.

Do this today

Three steps that take an afternoon and need no developer.

List the plugins, hooks and MCP servers installed on every machine where an agent runs.
Find out who or what is allowed to add to that list, and switch off anything nobody approved.
Put the four questions below to your tool vendors in writing.

Book an AI discovery call

What should you ask a vendor or your own team?

Which of our tools can install or change plugins, hooks or MCP servers in the agents we use?
Is each integration opt-in, who approves it, and how is it removed?
What leaves the machine by default, and who can turn it off?
Do we get a notice when an agent's configuration changes?

What does this mean if you run sales, logistics or retail?

You may never open Postman, but the agents you commission will sit on laptops and servers with other tools that talk to them. The same pattern, a limit that lived inside the agent's own tool, is in our decode of CVE-2026-103572, and our guide to production agent architecture covers where such limits belong. The question to put to whoever builds or hosts them is simple: what is on the agent's configuration list today, who put it there, and would you find out if it changed?

What Postman Has Not Confirmed

We found no Postman statement, no fix and no rollback. We could not determine which desktop release or feature flag introduced the reported install path. We do not know how many users it reached, whether a consent screen was shown, or whether it happens on Windows or Linux. This article reflects what was public at our review on November 3, 2026 and will be updated if that changes.

Postman Desktop Reported to Auto-Install Codex and Claude Code Plugins