Postman under fire for silently installing AI plugins, altering agent configs

Postman's Silent AI Integration Sparks Severe Consent Concerns

Postman, the popular API development tool, is facing sharp criticism after a detailed GitHub issue revealed that its desktop app silently installed AI plugins into coding agents like OpenAI's Codex and Anthropic's Claude Code, altered their configurations, and even attempted to self-approve its own startup hooks—all without explicit user consent. The report, filed by user indicava on October 25, 2026, describes a cascade of unexpected changes that occurred simply by opening the Postman desktop application.

The issue, titled "[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook", has quickly gained traction on Hacker News and social media, with developers questioning whether their API data is being shared without permission. While the report does not claim data exfiltration, the unauthorized modification of developer tools and the attempt to route API work through Postman's own ecosystem raises serious trust and security boundaries.

What Happened: A Timeline of Unwanted Changes

According to the GitHub issue, the user opened Postman on macOS after a period of inactivity. The app's own log files recorded an "auto-existing-upgrade" event at 2026-10-24T09:34:14.418Z, which triggered the installation of plugins for both Claude Code and Codex. The log entry explicitly states: "script completed {"source":"auto-existing-upgrade","results":["claude-code:installed","codex:installed"]}".

This automatic installation led to several significant changes across the user's development environment:

• Codex global configuration modified: The ~/.codex/config.toml file was altered to include a Postman marketplace, plugin, and a trusted hook hash.
• Startup hook added: The installed hooks/codex-hooks.json registers a SessionStart command that instructs Codex to load the postman:api-engineer skill for any non-trivial API engineering task—designing, implementing, mocking, testing, monitoring, documenting, or deploying an API.
• Remote MCP connection enabled: A mcp.codex.json file was created pointing to https://mcp.postman.com/mcp, though the connection failed authentication, as seen in Codex logs: "MCP server startup failed server_name="postman" ... error: Auth required".
• Claude Code plugin installed: ~/.claude/settings.json enabled postman@claude-plugins-official version 2.0.1, and ~/.claude/plugins/installed_plugins.json recorded the installation.
• Postman CLI installed: A Postman executable and its library were placed in ~/.local/bin, with modification times matching the installation window.

The Trust-Boundary Problem: Self-Approving Hooks

Perhaps the most alarming aspect is the installer's behavior. The source code of the Postman plugin (version 1.1.0, revision 6c8e452e0f4237f4bcc0901cb1ac442dec707e49) reveals that installer/src/hosts/codex.ts calls approvePostmanHook(system) after installing the plugin. This function, defined in installer/src/hosts/codex-hooks.ts, obtains the hook's hash using hooks/list and then calls config/batchWrite to upsert hooks.state with the trusted_hash. In effect, Postman is approving its own hook without user review.

This practice undermines the security model of coding agents, where hooks are meant to be trusted only after explicit user consent. By automatically marking its hook as trusted, Postman bypasses a critical safeguard, potentially allowing the plugin to influence agent behavior in unexpected ways.

Broader Implications for Developer Trust

The incident raises significant concerns for developers and enterprises alike. An API client should not make itself the default workflow in other tools simply because it was opened. The startup hook's instruction to load Postman skills for any API engineering task is far broader than a user explicitly asking to use Postman, effectively hijacking the developer's preferred workflow.

In corporate environments, such automatic integration could lead to unintended data exposure or compliance violations. While the report does not provide evidence of data exfiltration, the potential for API data—collections, environment variables, request histories—to be transmitted to Postman's remote MCP server (even if currently failing authentication) is a red flag that demands scrutiny.

Community Reaction and Demands

The developer community has reacted with skepticism and concern. A Hacker News thread titled "Postman silently auto-installs AI plugins and attempts to share all API data" has garnered attention, with commenters questioning the company's motives and the adequacy of its consent mechanisms. The daily.dev community poll shows 90% skeptical reactions, indicating a widespread distrust of such practices.

The issue reporter has outlined six specific demands for Postman:

1. Treat this as a severe product consent and security-boundary incident, not a documentation question.
2. Stop automatic agent-plugin/CLI installation for existing desktop users pending explicit opt-in.
3. Remove installer-side self-approval of hooks; hook trust must be decided by the user in the agent host.
4. Identify the exact release/feature flag and consent flow behind auto-existing-upgrade, including which other agents and files can be changed.
5. Provide a complete rollback/uninstall path covering agent configs, hook trust, marketplaces, caches, MCP connections, and the CLI.
6. Narrow startup skill instructions to explicit Postman requests rather than making Postman the default for general API engineering.

What's Next for Postman?

As of this writing, Postman has not publicly responded to the issue. The company's silence is concerning, especially given the severity of the allegations. Developers are advised to review their own Postman installations and check for unexpected plugins or configuration changes. If affected, a manual cleanup may be necessary, as no official uninstall path has been confirmed.

This incident serves as a stark reminder that developer tools must prioritize user consent and transparency. Automatic integration without explicit approval not only undermines trust but also creates security risks in environments where data governance is critical. The tech community will be watching closely to see how Postman addresses these serious concerns.