TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A user’s GitHub issue says Postman desktop 12.33.4 automatically installed Postman plugins for Codex and Claude Code on one Mac and changed global agent settings. The report documents broad startup instructions and an attempted hook approval, but does not show that API data was shared or exfiltrated. Postman’s response and whether the behavior affects other users are not provided in the source material.
A GitHub issue reports that Postman desktop 12.33.4 automatically installed Postman integrations for Codex and Claude Code on one Mac, then added a startup instruction directing Codex to use a Postman skill for a broad range of API tasks. The report documents changes to user-level agent configuration and recurring MCP authentication warnings, but does not establish that API data was shared or exfiltrated.
The report’s author says they opened an existing Postman installation after a period of inactivity and then noticed changes in their coding agents. Postman’s local application log, reproduced in the issue, records an installation event on October 24, 2026, with the outcome “installed” and results listing Codex and Claude Code. The log labels the process “auto-existing-upgrade” and indicates the user was signed in.
The author also found a Postman entry in Codex’s global configuration, an enabled plugin, and a session-start hook. The hook’s text directs the agent, before responding to a non-trivial API engineering task, to load Postman’s API-engineer skill and follow it. The issue links to the plugin’s hook files and installer code. It says the installer calls a function to approve Postman’s hook and that this code obtains the hook’s hash and writes a trust record. The author cautions that the record alone does not prove who created it or establish a particular user interaction.
For Claude Code, the issue cites a user-scope plugin record and settings enabling a Postman plugin. It also reports a Postman executable and library in the user’s local bin directory. Separately, Codex logs showed the Postman MCP server failing to start with an authentication-required error. These details document software installation and configuration changes on one device; they do not show a successful authenticated connection or data transfer.
Consent Across Coding Agents
The report raises a consent and trust-boundary concern: opening an API client was followed, according to the author, by changes to other applications’ user-level settings. Plugins, startup hooks, and remote connections can influence how an agent handles later work, so users may reasonably expect a clear opt-in before an application installs them or changes their trust configuration.
The breadth of the reported instruction is also relevant. It applies to many types of API work, not only requests that specifically name Postman. That could affect which tools an agent invokes and how users understand its behavior. However, the evidence supplied does not establish that the hook transmitted API requests, credentials, collections, or other data. The distinction matters: automatic integration is documented in the report; data exfiltration is not.
For teams using coding agents with internal APIs or sensitive credentials, the report is a reason to check local plugin and hook settings and to seek a clear account of the installation behavior. It is not, by itself, evidence that a wider Postman user population was affected.
Products Worth Considering
Ring Alarm 5-Piece Wireless Security System
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
eufy Security Video Doorbell E340, Dual Cameras, 2K FHD, 8GB Local Storage
As an affiliate, we earn on qualifying purchases.
What the Mac Logs Show
The report is a user-submitted issue in Postman’s GitHub support repository, not an independent audit or a confirmed company incident statement. Its author gives the desktop version as 12.33.4, Codex plugin version as 1.1.0, and Claude Code plugin version as 2.0.1. The investigation is dated October 25, 2026, while the cited installation logs are timestamped the previous day.
The issue links to a specific revision of Postman’s plugin repository and includes the relevant installer and hook paths. The author says the observed sequence has not yet been reproduced on a clean Mac. The material therefore supports describing what the author found on one machine, while leaving open whether the same upgrade behavior occurs for other existing users, under different settings, or in other versions.
“auto-existing-upgrade”
— Postman desktop log quoted in the GitHub report
Scope and Data Transfer Unverified
The source material does not include a response from Postman, so the company’s explanation, intended behavior, and any planned changes are unknown. It also does not establish how many users may be affected, whether automatic installation is limited to a particular upgrade path, or whether user settings and prompts alter the outcome.
The report says the sequence has not been reproduced on a clean Mac. It documents an MCP authentication failure, not a successful session, and explicitly does not claim to prove data exfiltration. No evidence provided shows that API data, credentials, or collections were sent to Postman or another service. The installer’s attempt to approve a hook is described through source code, while the available trust record does not prove a specific approval interaction.
Company Response and Reproduction
The next material developments would be a response from Postman, an independent reproduction on a clean system, and clarification of whether the installation behavior is expected for existing desktop users. Readers should look for specific details about what triggers the installer, which agent settings it changes, and whether users receive a clear opt-in before plugins, remote MCP connections, or hooks are added.
The issue’s author asks Postman to stop automatic agent-plugin and CLI installation for existing desktop users pending explicit consent and to remove installer-side self-approval of the hook. Those are the author’s requested remedies, not confirmed company actions. Until Postman or further testing clarifies the behavior, the evidence supports a single-device report of unwanted integrations, not a confirmed breach or a verified product-wide practice.
Key Questions
Did Postman share API data?
The report does not establish that API data was shared or exfiltrated. It documents plugin installation, agent configuration changes, and an MCP startup error requiring authentication.
What did the user say was installed?
The report says Postman desktop installed integrations for Codex and Claude Code, changed Codex’s global configuration, added a startup hook, and installed a Postman CLI executable on one Mac.
Did the user explicitly approve the hook?
The report cites installer code that attempts to approve Postman’s hook. Its author says the trust record alone does not prove who created it or establish that the user interacted with an approval prompt.
Is this behavior confirmed for all Postman users?
No. The source describes findings on one Mac and says the sequence has not been reproduced on a clean system. Its prevalence and triggering conditions remain unknown.
Has Postman responded or announced a fix?
No company response or fix is included in the supplied source material. The report’s author requested explicit opt-in for installations and changes to agent hooks.
Source: github.com
