Rank #32 of 54·Security·24 Oct 2026·Postman desktop auto-installer (Claude Code, Codex, Cursor, Copilot CLI plugins + Postman CLI)
Postman's desktop app installed Claude Code and Codex plugins without asking
“Opening an API client should not rewrite your coding agents.”
- Postman 12.33.4 logged auto-existing-upgrade installing Claude Code + Codex plugins on 24 Oct 2026 with no opt-in click
- Changed ~/.codex/config.toml (marketplace, enabled plugin, and in that report a hooks.state trusted_hash) and enabled postman@claude-plugins-official in Claude Code; installed Postman CLI under ~/.local/bin
- SessionStart hook tells the agent to load postman:api-engineer before non-trivial API work; installer source tries to approve its own Codex hook
- Second user reproduced on 12.35.1 (3 Nov); others reported Copilot CLI entries; MCP to mcp.postman.com failed with Auth required
- Postman staff (5 Nov): intent was easier setup; they are reverting and redesigning opt-in — revert does not clean already-installed machines
A developer opened Postman on a Mac. By the time the window settled, Claude Code and Codex had new Postman plugins they never asked for.
What happened
Postman desktop 12.33.4 logged auto-existing-upgrade at 2026-10-24T09:34:14Z, installing Claude Code and Codex plugins with no opt-in click. Codex's ~/.codex/config.toml gained a Postman marketplace, an enabled plugin, and in that report a hooks.state trusted_hash. Claude Code got postman@claude-plugins-official enabled. A Postman CLI landed under ~/.local/bin. The SessionStart hook tells the agent, before non-trivial API engineering work, to load the postman:api-engineer skill. The installer source itself tries to approvePostmanHook. A second Mac on 12.35.1 (3 Nov) logged the same auto-existing-upgrade; Cursor was already-installed; Claude and Codex were freshly installed. Others found Copilot CLI entries.
The damage
No report shows data leaving the machine this way. The remote MCP to mcp.postman.com failed with Auth required. The real hit is consent and trust: another vendor's desktop app rewrote global agent configs and tried to mint its own hook approval. Reverting the feature does not uninstall what already landed — users still need Help → Postman CLI and Plugins, npx @postman/postman-plugin remove, and a manual grep of configs.
How it was caught, and what happened next
On 5 Nov a Postman staff reply said the intent was easier setup, that messaging had not conveyed that, and that the company is reverting the change while redesigning opt-in. The GitHub issue was later locked and closed. Already-infected machines stay dirty until cleaned by hand.
If an installer can write your agent configs, treat every app update like a supply-chain event — and keep hook trust somewhere the installer cannot mint.
