TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A user’s GitHub issue says opening Postman 12.33.4 on a Mac was followed by automatic Codex and Claude Code plugin installations, changes to Codex’s global configuration and an attempted hook approval. The report documents unexpected integrations and authentication failures, but does not show that API data was transmitted or that the behavior affects other users.
A Postman user says opening the desktop app on a Mac was followed by automatic installations of Postman plugins for Codex and Claude Code, changes to Codex’s global configuration and startup instructions directing API work through Postman tools. The GitHub report describes the behavior as an unwanted change to other applications’ settings, but says it does not establish that API data was transmitted.
The report identifies Postman desktop version 12.33.4 and Codex plugin version 1.1.0. The author says Postman’s local log recorded an existing-user upgrade on October 24, 2026, with the result “claude-code:installed” and “codex:installed.” The issue also reports a Claude Code plugin version 2.0.1 and a separately installed Postman CLI. These are findings from one user’s Mac, not confirmation of a broader rollout.
According to the issue, Postman’s plugin added a Codex session-start hook that instructs the agent to load Postman’s API-engineer skill before a wide range of non-trivial API tasks. The user says this explains why Codex repeatedly routed API work through Postman skills. The report also points to installer source code that calls an approval function for Postman’s hook. The author cautions that the resulting trust record does not by itself show who created it or prove a particular user interaction.
The setup also configured a remote MCP connection at mcp.postman.com. Codex logs cited in the report showed authentication failures during startup. That indicates the connection was not working as configured at the time described; it does not establish that the service received API data. The report’s author explicitly says the evidence demonstrates unwanted integration and instruction changes, not data exfiltration.
Consent Across Coding Agents
The report raises a consent and trust-boundary concern: opening one desktop application reportedly changed settings in separate coding-agent tools and added instructions that could affect how those tools handle API-related work. Hooks and plugins can shape an agent’s behavior at startup, so users may not realize that an application has added a workflow preference outside its own interface.
For developers, the distinction between installing a plugin and sending data matters. The evidence described supports a report of automatic installation, configuration changes and failed MCP authentication. It does not show that API collections, credentials, requests or other user content were shared. Treating the allegation as proof of data exposure would go beyond what the report establishes.
The issue’s author asks Postman to stop automatic agent-plugin and CLI installation for existing desktop users until they give explicit permission, and to remove installer-side self-approval of hooks. Those are requests from the reporter, not confirmed company actions. The public record supplied here does not include a response from Postman.
Products Worth Considering
Apple MacBook Pro 14 2021 with M1 Max, 64GB RAM, 2TB SSD, Silver
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 512GB SSD, and 12MP Center Stage camera
Apple MacBook Pro 16.2-inch with M5 Pro, 18-Core CPU, 20-Core GPU, 48GB Memory, 1TB SSD, Wi-Fi 7, Silver
As an affiliate, we earn on qualifying purchases.
What the Mac Logs Show
The author says they investigated after seeing recurring MCP authentication warnings and Codex repeatedly invoking Postman skills. They examined Postman logs, Codex configuration and plugin files, Claude Code settings and installed-plugin records. The issue gives a timestamp of October 24, 2026, for the installation entries and says the investigation was conducted the following day.
The report links to Postman’s plugin repository at a specific source revision and cites files for the Codex startup hook and installer. It says the setup changed user-wide Codex configuration, registered a Postman marketplace and enabled the plugin. It also describes a Claude Code plugin entry and a Postman executable in the user’s local bin directory. The author says private paths, account identifiers and credentials were excluded from the public report.
The author has not reproduced the sequence on a clean Mac. The reported steps are to open an existing Postman desktop installation after a period without use, then inspect the logs and agent settings. That limitation means the issue is a documented individual report, not an independently verified account of behavior across installations.
“auto-existing-upgrade”
— Postman’s local log, as quoted in the GitHub issue
Scope and Data Transfer
Postman has not responded in the source material provided, and it is not clear whether the reported installation behavior is intended, limited to certain settings or versions, or affecting other users. The report says the sequence has not been reproduced on a clean Mac. No independent test or company confirmation is included.
It also remains unclear whether the user was shown any prompt or had previously enabled a related setting. The source code and logs cited by the reporter support their account of automatic installation and an attempted hook-approval process, but the report does not establish a specific user interaction that created the trust record. Most importantly, it supplies no evidence that API data was shared or accessed.
Questions for Postman
The next development is likely to depend on whether Postman responds to the issue and clarifies the conditions that trigger agent-plugin or CLI installation for existing users. The company could also address whether users receive a clear, specific opt-in before changes are made to Codex or Claude Code, and how hook approval is handled. No fix, investigation or policy change is confirmed in the source material.
Users seeking to assess their own setup can compare their installed plugins and agent configuration with the paths and versions described in the issue, while avoiding assumptions that the same behavior occurred on other systems. Until Postman or independent testing provides more evidence, the report should be treated as a single-user account of unwanted integrations, not confirmation of widespread data exposure.
Key Questions
What does the GitHub report say Postman installed?
The user reports automatic installations of Postman plugins for Codex and Claude Code, changes to Codex’s global configuration, a remote MCP setting and a separate Postman CLI on one Mac.
Does the report prove Postman shared API data?
No. The author says the evidence documents unwanted integrations and instruction changes but does not establish data exfiltration. The reported MCP connection also returned an authentication error.
Has Postman confirmed the behavior?
No Postman response or confirmation is included in the supplied source material. The behavior has not been reproduced on a clean Mac, according to the reporter.
What changes does the reporter want?
The reporter asks Postman to pause automatic plugin and CLI installation for existing desktop users until they explicitly opt in, and to remove installer-side approval of its own hook.
Source: github.com
