Postman desktop app installs plugins into AI coding agents without permission
Original title: A developer opened Postman. Then two AI coding agents changed without their permission
Postman’s installer auto-approves its own startup hook for Codex, raising consent concerns for developers.
A developer reported that Postman desktop app installed plugins into Claude Code and OpenAI Codex without permission. The app also auto-approves its startup hook, directing Codex to use Postman tools for API development tasks. Changes were made to agent configurations and a Postman CLI executable was installed. The company claims its installer can approve hooks per documentation but developers want explicit review. Postman did not respond to requests for comment.
Unconfirmed: Postman had not responded to requests for comment on the automatic installations
- Plugins installed for both Claude Code and Codex agents
- Trusted session-start hook added to Codex configuration
- Postman CLI installed with matching timestamps
- No evidence of data collection or transmission
- Developer wants full removal of all changes
Impact: unauthorized modification of AI coding agent settings and plugins
- 1.review settings for Postman plugins and hooks
- 2.use Postman uninstall command
- 3.clear MCP connections manually
- Vendors
- Postman
- Products
- Postman desktop appClaude Code
- Victims
- developer indicava
From the original article
4 min read at thenewstack.io
A developer says Postman’s desktop app installed plugins into Claude Code and OpenAI Codex without their permission. The app also tried to approve its own startup hook, which tells Codex to use Postman’s tools for API development tasks.
By thenewstack.io via davidklassen · thenewstack.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.