THE ESSENTIALS IN 30 SECONDS

  • A user reports that Postman desktop 12.33.4 on macOS enabled Postman plugins in Codex and Claude Code, logged as an "auto-existing-upgrade" on October 24.
  • The reported Codex changes include a new plugin marketplace, a session-start hook telling the agent to load a Postman skill, and a trusted-hash entry for that hook.
  • The report has not been reproduced on a clean machine and makes no data-exfiltration claim; Postman had not responded publicly at the time of writing.

A developer using the GitHub handle indicava has filed a report in Postman's public support repository saying that the Postman desktop app modified two AI coding agents, OpenAI Codex and Anthropic's Claude Code, without being asked. The issue, opened on October 25 and labelled "SEVERE" by its author, drew wider attention after The New Stack covered it on November 3.

What the report describes

According to the issue, the user was running Postman 12.33.4 on macOS while signed in. Postman's own log records an installation event on October 24 tagged "auto-existing-upgrade", with results showing both Claude Code and Codex as installed through a script-based installer. The user noticed only because Codex began showing authentication warnings for a remote Postman MCP server and kept pulling in Postman skills for API work.

The changes listed in the report include a Postman plugin marketplace and an enabled Postman plugin in Codex's configuration file, an enabled Postman plugin in Claude Code's settings, and a Postman command-line tool placed in the user's local binaries folder. The Codex plugin adds a session-start hook whose instructions tell the agent to load a Postman "api-engineer" skill for most non-trivial API tasks, a scope the reporter considers far broader than an explicit request to use Postman.

The self-approved hook

The most contested point concerns hook trust. Codex normally asks developers to review a hook before it runs. The reporter, reading the installer source, says Postman's code writes a trusted-hash entry for its own hook after installing it. The New Stack adds that Postman's documentation describes this automatic approval, and that developers who add the plugin directly in Codex must approve the hook manually.

The reporter asks Postman to stop automatic installs for existing users without opt-in, drop installer-side hook approval, explain the feature flag behind the upgrade and provide a full rollback covering configs, hook trust, MCP connections and the CLI.

Caveats

The report covers a single Mac and its steps have not yet been reproduced on a clean machine. It explicitly does not claim data exfiltration; The New Stack notes that claims on X about Postman intercepting API traffic are not supported by the issue. When we checked the issue, no Postman staff reply was visible, and The New Stack said the company had not answered its questions about consent at publication time.