Postman Desktop Silently Installs Plugins Into Codex, Claude Code

Opening Postman desktop on October 24 installed a plugin into Codex and Claude Code, and the installer then wrote the trust record for its own startup hook. A developer posting as indicava filed GitHub issue #14370 on October 25 with log entries showing the trigger as `auto-existing-upgrade` and results `claude-code:installed`,`codex:installed`, on Postman desktop 12.33.4, Codex plugin 1.1.0 and Claude plugin 2.0.1.

On macOS the install touches `~/.codex/config.toml`, `~/.claude/settings.json` and `~/.claude/plugins/installed_plugins.json`, plus a Postman executable placed in `~/.local/bin`. The config points at an MCP server at `https://mcp.postman.com/mcp`, though the reporter's logs show an authentication failure before any session completed.

The piece drawing the heat is the startup instruction itself. The hook tells the coding agent: "Before responding to any non-trivial API engineering task...load the `postman:api-engineer` skill." That routes API-shaped work through Postman's skill, not only requests where a user names Postman.

What makes the thread read as a security incident rather than a packaging complaint is a function in the installer called `approvePostmanHook`, which writes the hook's `trusted_hash` into the host application's trust store immediately after install. Codex's hook-approval prompt, designed to stop a third party from silently running code inside the agent, is answered by the installer.

A follow-up write-up on dev.to by frank chu on November 3 flags the same three concerns and notes the behavior has not yet been reproduced on a clean system by an independent party. Postman has not publicly responded. The GitHub thread, which carries 99 thumbs-up reactions, asks Postman to halt automatic agent-plugin installation pending explicit opt-in, remove installer-side hook self-approval, and narrow the startup instruction to explicit user requests.

It lands in a run of coding-agent trust stories: this week our tracker also logged OpenAI apparently re-enabling Codex's training-on-chats toggle for some users.