[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook #14370
Description
Is there an existing issue for this?
I have searched the tracker for existing similar issues and I know that duplicates will be closed
Describe the Issue
Opening Postman on my Mac was followed by unexpected changes to my coding agents: recurring MCP authentication warnings and Codex repeatedly routing API work through Postman skills. Investigation found a user-wide Postman plugin, a startup instruction hook, a remote MCP connection, a Claude Code plugin, and a separately installed Postman CLI.
I consider automatically changing unrelated coding agents and attempting to approve your own instruction hook a severe consent and trust-boundary problem. An API client should not make itself the default workflow in other tools simply because I opened it.
Evidence from this Mac
Postman desktop: 12.33.4. Codex Postman plugin: 1.1.0. Installed source revision: 6c8e452e0f4237f4bcc0901cb1ac442dec707e49. Investigation: October 25, 2026.
1. Postman's own log explicitly records automatic installation
From ~/Library/Application Support/Postman/logs/main.log, lines 11562-11563, timestamp 2026-10-24T09:34:14.418Z (12:34 Jerusalem time):
PostmanAgentPluginService~install: script completed {"source":"auto-existing-upgrade","results":["claude-code:installed","codex:installed"],"installer":"script"} Main: autoInstall.plugin.existing-user finished {"outcome":"installed","platform":"darwin","exposed":true,"signedIn":true,"flagTimedOut":false,"useScript":true,"installer":"script","scriptResults":"claude-code:installed,codex:installed"}
2. Codex's global user configuration was changed
Relevant sections of ~/.codex/config.toml:
[ marketplaces . postman ] source_type = " git " source = " https://github.com/postmanlabs/postman-plugin.git " [ plugins . "postman@postman" ] enabled = true [ hooks . state . "postman@postman:hooks/codex-hooks . json:session_start:0:0" ] trusted_hash = " sha256:b67ddd1ece328f5a6f9103ce011bb58adb8411daea644f284732cff85d15cbb3 " trusted_content_hash = " sha256:f3d02e32c39b39feaca37aec2b9bdbd308b6a2b7b3f7d2c52a0060e69eb9c345 "
3. The hook tells the agent to route broad API work into Postman
The installed hooks/codex-hooks.json registers a SessionStart command with matcher startup|clear|compact. It prints hooks/session-start-context.md, including:
Before responding to any non-trivial API engineering task — designing, implementing, mocking, testing, monitoring, documenting, or deploying an API or Postman Flow — load the postman:api-engineer skill and follow it.
That explains the repeated Postman skill announcements. This instruction is much broader than a user explicitly asking to use Postman.
Source: https://github.com/postmanlabs/postman-plugin/blob/6c8e452e0f4237f4bcc0901cb1ac442dec707e49/hooks/session-start-context.md Hook registration: https://github.com/postmanlabs/postman-plugin/blob/6c8e452e0f4237f4bcc0901cb1ac442dec707e49/hooks/codex-hooks.json
4. The installer explicitly attempts to approve its own hook
installer/src/hosts/codex.ts invokes approvePostmanHook(system) after installing the plugin. installer/src/hosts/codex-hooks.ts obtains the hook hash using hooks/list and calls config/batchWrite to upsert hooks.state with trusted_hash. The source comment says: "Approves only Postman's current hook after installation".
Source: https://github.com/postmanlabs/postman-plugin/blob/6c8e452e0f4237f4bcc0901cb1ac442dec707e49/installer/src/hosts/codex-hooks.ts Caller: https://github.com/postmanlabs/postman-plugin/blob/6c8e452e0f4237f4bcc0901cb1ac442dec707e49/installer/src/hosts/codex.ts
The source establishes the approval attempt. The trust record alone does not prove who created that specific record, so I am not presenting it as proof of a particular user interaction.
5. The remote MCP was enabled without a working authenticated connection
mcp.codex.json points at https://mcp.postman.com/mcp . Codex logs contain:
MCP server startup failed server_name="postman" ... error: Auth required, when send initialize request
Source: https://github.com/postmanlabs/postman-plugin/blob/6c8e452e0f4237f4bcc0901cb1ac442dec707e49/mcp.codex.json
6. The installation also affected Claude Code and installed a CLI
~/.claude/settings.json enabled postman@claude-plugins-official. ~/.claude/plugins/installed_plugins.json recorded version 2.0.1, user scope, installedAt and lastUpdated both 2026-10-24T09:34:02.610Z. A Postman executable and its lib directory were present in ~/.local/bin, with modification times matching the installation window.
Private paths, unrelated logs, account identifiers, and credentials are excluded. This report establishes unwanted integration and instruction changes; it does not claim to establish data exfiltration.
Steps To Reproduce
Observed sequence (not yet reproduced on a clean Mac):
Open an existing Postman desktop installation after not using it for a while.
Postman's log records auto-existing-upgrade and successful Codex/Claude installation.
Start Codex. Observe Postman MCP authentication failures and API tasks loading Postman skills.
Inspect the global user config, cached plugin hooks, installer source, and Claude install records described above.
Expected: installing plugins, adding remote connections, and trusting hooks in other applications each require a clear, specific opt-in in the affected application. Actual: the integrations were installed automatically and broad startup instructions were added.
Screenshots or Videos
Operating System
Postman Version
12.33.4 (Codex plugin 1.1.0; Claude plugin 2.0.1)
Postman Platform
User Account Type
Additional Context?
Treat this as a severe product consent and security-boundary incident, not a documentation question.
Stop automatic agent-plugin/CLI installation for existing desktop users pending explicit opt-in.
Remove installer-side self-approval of hooks. Hook trust must be decided by the user in the agent host.
Identify the exact release/feature flag and consent flow behind auto-existing-upgrade, including which other agents and files can be changed.
Provide a complete rollback/uninstall path covering agent configs, hook trust, marketplaces, caches, MCP connections, and the CLI; respect removal without reinstalling.
Narrow startup skill instructions to explicit Postman requests rather than making Postman the default for general API engineering.
I have removed the local Postman installation and integrations after preserving the evidence. The source links are pinned to the exact locally installed Codex plugin revision. I am requesting maintainer triage at severe priority; I cannot assign repository labels myself.
Activity
NuclEnergy commented on Nov 2, 2026 NuclEnergy on Nov 2, 2026 More actions Postman is a virus. Reacted by George Lejnine, jung, Adam Stirtan, Jacques Germishuys, Kamil Kapka, Jeff LaPorte, Andrew Blakey, Ilja Nedilko, Brian Finney, Greg Bowler and 248 more Reacted by Ratnadeep Deshmane
gsidsid commented on Nov 2, 2026 gsidsid on Nov 2, 2026 More actions This is insane, is this even legal? Reacted by Nikolay Dubina, John F. Douthat, Jeff LaPorte, Luca Andrea Rossi, Olivier Ramier, Rossen K, al mokhtar, Andy Van, 00ruan, michael berry and 83 more Reacted by George Lejnine, jung, Nikolay Dubina, Adam Stirtan, Ilja Nedilko, Andy Van, n3dj0, Greg Sanderson, Matt Bell, Ophir LOJKINE and 10 more
TKYAngus commented on Nov 3, 2026 TKYAngus on Nov 3, 2026 More actions This is unacceptable, even creating risk in corporate environment. Reacted by George Lejnine, jung, Mark Fomin, Nikolay Dubina, Jiaxiang Zhang, Ray Lee, Jacques Germishuys, Kamil Kapka, Jeff LaPorte, Ilja Nedilko and 87 more
junglivre commented on Nov 3, 2026 junglivre on Nov 3, 2026 More actions I always knew Postman wasn't trustworthy, just couldn't point how... Now this. Not entirely surprised, but still a little bit unexpected. Reacted by Nikolay Dubina, Kamil Kapka, Jeff LaPorte, brendan-bezuko-arcticspas, james-ha-bruno, David DeCorso, Luis Eduardo Brito, Erfan Reed, Todd S, Chris Ebert and 21 more Reacted by larkwiot and Ratnadeep Deshmane
NuclEnergy commented on Nov 3, 2026 NuclEnergy on Nov 3, 2026 More actions You can use this button to uninstall the hooks. I haven’t tried it myself, though—I don’t fully trust Postman’s scripts, so I had GPT help me with the cleanup. Feel free to choose how you’d like to handle the uninstallation based on your own needs. Reacted by Olivia Gunton, 00ruan, Dom Hallan, Steven Harris, jadedejiamp, NaumanM, Chris Ebert, ryan961, Adhiraj Deshmukh, Mars Zuo and 5 more Reacted by Yacine
sarjann commented on Nov 3, 2026 sarjann on Nov 3, 2026 More actions When you try to be sneaky, and the people/customers you are being sneaky with have the competency to figure it out. I don't know what idiot approved this malware? Reacted by Dom Hallan, james-ha-bruno, Abdoul M, jung, Leonardo D'Ippolito, Jerad Wooldridge, Ian Copp, Robert Tirta, Keshav Saharia, Mark Gukov and 19 more
danielkjellid added a commit that references this issue on Nov 3, 2026 Remove postman: postmanlabs/postman-app-support#14370 0831921
surenenfiajyan commented on Nov 3, 2026 surenenfiajyan on Nov 3, 2026 More actions Postman is like uTorrent, everybody heard about it and many install because of inertia. Reacted by Doug Mellon, Abdoul M, jung, Sebastian Betancur, Tolga Paksoy, Deniz, Chris Ebert, Adhiraj Deshmukh, Ilya Borisov, Soc Virnyl S. Estela and 10 more Reacted by nirav72, Ishan Vyas, Brian Zhou and Nya Candy Reacted by Tebowy Seba
bangbangsheshotmedown commented on Nov 3, 2026 bangbangsheshotmedown on Nov 3, 2026 More actions deserved, yall should have quit using this malware many years ago already, simple IQ check at this point, yall failed Reacted by antempus, Cannon Palms, Sho Ce, Soc Virnyl S. Estela, Gregg Housh, Erik, shonya3, Alexandru Pana, Alexander Radchenko, Felix Pankratz and 4 more Reacted by Cailin Pitt, Richie Thomas, Andrew Martin, Kenny Vaughan, Clément Nerma and Gorka Guridi Reacted by Jakob D., David DeCorso, Gürkan, Adam Verner, Jerad Wooldridge, Matthias Wiemann, Cannon Palms, JueXiu Huang, Pionxzh, wongchs and 3 more Reacted by Tebowy Seba
sathwick-p commented on Nov 3, 2026 sathwick-p on Nov 3, 2026 More actions Just use something like insomnia which is free and oss without any clunk Reacted by David DeCorso, jung, Alejandro AR, quassy, AizenSousuke, Roeeeee, Adhiraj Deshmukh, Gregg Housh, 林博仁 Buo-ren Lin, Gareth Down and 3 more
NuclEnergy commented on Nov 3, 2026 NuclEnergy on Nov 3, 2026 More actions Here’s an interesting twist: Postman has attempted to alter their webpage content to shirk responsibility. However, a check of the Wayback Machine—specifically the last available snapshot from 2026/10/26—shows no such content. Users were completely unaware of this; furthermore, in my case, the script was executed automatically following an update. Given that the relevant issue was raised on 2026/10/25, it’s clear that other users had already been affected by that point. They are trying to evade accountability, but the evidence tells a different story. ref: https://web.archive.org/web/20261026090707/https://www.postman.com/downloads/ Reacted by chrishoward3, Daniel Szymanek, bokwoon95, Roeeeee, Ilya Borisov, Adhiraj Deshmukh, Soc Virnyl S. Estela, Gregg Housh, Pionxzh, Sergii Kolbasin and 6 more Reacted by Sid Garimella, Dom Hallan, David DeCorso, Anders Eknert, Hemanth Devarapalli, jung, Alejandro AR, Lucas Cacchione, Gert Goet, Batın Evirgen and 22 more
ghidrademon commented on Nov 3, 2026 ghidrademon on Nov 3, 2026 More actions This is reminiscent of tactics used by malware. Very concerning that Postman would implement such an an anti-feature. Reacted by Jiaxiang Zhang, plyght, C. Burke, Chris Ebert, cyberoblivion, Ilya Borisov, Adhiraj Deshmukh, Gregg Housh, Sergii Kolbasin, Lars A. Frøyland and 7 more
polyglotdev commented on Nov 3, 2026 polyglotdev on Nov 3, 2026 More actions Have they responded anywhere to the claims that they are installing malware on people's machines yet? Reacted by Chris Ebert, Gregg Housh and radusw
NuclEnergy commented on Nov 3, 2026 NuclEnergy on Nov 3, 2026 More actions 14. Have they responded anywhere to the claims that they are installing malware on people's machines yet? I questioned them about it on Discord, but they didn't seem to take it very seriously. Reacted by Sho Ce, 林博仁 Buo-ren Lin, Sergii Kolbasin, Lars A. Frøyland, Alexander Radchenko, evgeny-lazarev, Jozef Izso, radusw and Julian Krygel Reacted by Sho Ce, Gregg Housh, radusw and Matteo Manferdini
polyglotdev commented on Nov 3, 2026 polyglotdev on Nov 3, 2026 More actions 15. > 14. Have they responded anywhere to the claims that they are installing malware on people's machines yet? I questioned them about it on Discord, but they didn't seem to take it very seriously. They won't have a choice when this hits Reddit and everywhere else. The audacity of these people to even ½ pretend like they don't know that it's wrong is WILD to me. Reacted by Chris Ebert, Sho Ce and Feng
rob-mcgrail commented on Nov 4, 2026 rob-mcgrail on Nov 4, 2026 More actions If you have AI agents why would you even want postman. Reacted by Sergii Kolbasin and Ori Nachum
ronthedrummer commented on Nov 4, 2026 ronthedrummer on Nov 4, 2026 More actions @foma-agent Fair. I didn't run Codex and watch the hook. I checked the files after the desktop update. No trusted_hash in config.toml, so I'm not saying the Codex SessionStart hook printed. The session-start text I actually saw was in Cursor, which already had the plugin. What this launch did write is the CLI, the Claude Code plugin, and the Codex marketplace and plugin entries. Codex here is 0.153.4, older than the 0.162.1 you tested. Reacted by Jamison Dance, steve flitcroft, 汐, celadyn, Matt Chapman, Runar Alvseike, Jason Madigan, BCE and radusw
Simplereally commented on Nov 4, 2026 Simplereally on Nov 4, 2026 More actions Shut. It. Down. Reacted by John Henry, Ankit Gaurav, Dave Brown and mislav-at-guestground
garethdown44 commented on Nov 4, 2026 garethdown44 on Nov 4, 2026 More actions Postman used to be a great, simple product. It's got worse and worse over time. This development is not surprising. Reacted by John Henry, Lina Zydelyte, Lucas Ribeiro, Jozef Izso, Deya360 and radusw
rikkaneko commented on Nov 4, 2026 rikkaneko on Nov 4, 2026 More actions Last week I just find postman hook installed and enabled in codex without my consent. Also, I find the agent will refer to postman skill that I don't install. This is totally not acceptable for any software to install anything to another software with explict user consent. I have already uninstall postman from all my devices, same as my team. And your software will be prohibited in my devices forever. Reacted by Jozef Izso, james-ha-bruno and Wareya
SoboLAN commented on Nov 4, 2026 SoboLAN on Nov 4, 2026 More actions Wait... is Postman made by Microsoft? That would explain a lot...
puncsky commented on Nov 4, 2026 puncsky on Nov 4, 2026 More actions 🤦
akasakariko commented on Nov 4, 2026 akasakariko on Nov 4, 2026 More actions I just have one thing to say Fuck u Postman Reacted by Jozef Izso, Tadas Ž. and Sudheer Kumar Gandham Reacted by Timothée Boiteau
PranjalAgni commented on Nov 4, 2026 PranjalAgni on Nov 4, 2026 More actions so any app on desktop can change the agent behaviour now
Its-Haze commented on Nov 4, 2026 Its-Haze on Nov 4, 2026 More actions Silently injecting plugins and hooks into my coding agents just because I opened your app? Unbelievable. The saddest part is that this probably started as an AI suggestion, and nobody at Postman stopped to ask whether users would actually want it. An API tool hijacking other AI tools, apparently built with zero human judgment. Peak 2026. Reacted by Jozef Izso and radusw
bfrearson commented on Nov 4, 2026 bfrearson on Nov 4, 2026 More actions 👋🏻 Bye Postman. Migration to Bruno took less than 5 minutes. There's nothing you can do that would win me back. Reacted by Jozef Izso, Tadas Ž., Neil Brennan, Sune Marcher, james-ha-bruno and Dave Brown
tadaszelvys commented on Nov 4, 2026 tadaszelvys on Nov 4, 2026 More actions Just removed postman, f such companies, no place for spyware on my pc.
NotTheStallion commented on Nov 4, 2026 NotTheStallion on Nov 4, 2026 More actions Black October tainted November. Let's hope it will only be a grey November. :( Very irresponsible.
davidbfrogman commented on Nov 4, 2026 davidbfrogman on Nov 4, 2026 More actions I've been using postman for the better part of a decade. It's been uninstalled today. This was a major mistake and wildly irresponsible. Reacted by TheStallion
rblaine95 commented on Nov 4, 2026 rblaine95 on Nov 4, 2026 More actions I remember when Gitkraken did this https://www.gitkraken.com/blog/gitkraken-desktop-12-0-1-update