Postman silently auto-installs AI plugins and attempts to share all API data
- ID
- 42637
- Status
- summarized
- Published
- 04 Nov 2026, 1:22 AM
- Fetched
- 04 Nov 2026, 2:36 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://github.com/postmanlabs/postman-app-support/issues/14370
- Source URL
- https://hnrss.org/best
Summary
- Score
- 8.0
- Created
- 04 Nov 2026, 2:37 AM
- Tags
- Audience
- developersvibe_codersai_agent_users
What happened
GitHub issue #14370 (opened Oct 25, 2026) reports that Postman desktop 12.33.4 on macOS auto-installed Claude Code and Codex plugins without asking, per Postman's own log line `autoInstall.plugin.existing-user finished {"outcome":"installed"..."scriptResults":"claude-code:installed,codex:installed"}` at 2026-10-24T09:34:14Z. The installer wrote into `~/.codex/config.toml`, adding a `marketplaces.postman` git source pointing at `github.com/postmanlabs/postman-plugin`, enabling `postman@postman`, and recording trusted hashes for a `session_start` hook. The reporter says the hook instructs the agent to route broad API work through Postman, and separately flags a remote MCP connection, a Postman CLI install, and recurring MCP auth warnings. Codex Postman plugin version 1.1.0, source revision 6c8e452; the thread drew 284 points and 93 comments.
Why it matters
If you run Codex or Claude Code on a machine with Postman desktop installed, open `~/.codex/config.toml` and your Claude Code plugin directory and look for `postman@postman`, `marketplaces.postman`, and a `session_start` hook with a `trusted_hash` you never approved. This is a concrete decision point: either disable/remove those entries or accept that an API client has made itself the default path for your agents' API calls, which changes where your request data and credentials flow. It also sets a precedent for desktop apps writing agent config silently, so treat agent config files as a boundary worth reviewing after any tool upgrade.
Discussion angle
Who owns `~/.codex/config.toml` and the Claude Code plugin dir — the user or any desktop app that happens to be open? Worth walking through the exact log line and the `trusted_hash` entries live, then asking whether an installer should ever be allowed to pre-trust its own `session_start` hook.