# Postman desktop auto-installed Codex and Claude Code plugins — users object

> Postman's desktop app added AI agent plugins to developers' Codex and Claude Code setups without asking first.

- Org: Postman
- Date: 2026-11-03
- Category: security
- Source: https://github.com/postmanlabs/postman-app-support/issues/14370
- Canonical page: https://ai-tldr.dev/releases/postman-desktop-auto-installs-agent-plugins/

## In short

Postman desktop 12.33.4 installed its Codex and Claude Code plugins, a startup hook and an MCP server without asking, a GitHub issue reports. On November 3 Postman said it will make the opt-in clearer and review the hook.

## What it is

A GitHub issue titled '[SEVERE] Desktop auto-installs Codex/Claude plugins' reports that Postman desktop 12.33.4 added the Postman plugin to Codex (1.1.0) and Claude Code (2.0.1) on its own. The reporter found a Postman marketplace and plugin enabled in the global ~/.codex/config.toml, a remote MCP server at mcp.postman.com, and a Postman CLI placed in ~/.local/bin. A second user saw the same thing on 12.35.1, with a Cursor plugin also added.

## How it works

Postman's log shows an 'auto-existing-upgrade' step that installed the agent plugins for existing users. The plugin adds a SessionStart hook that tells the coding agent to load a Postman API skill for 'any non-trivial API engineering task'. The reporter says the installer also calls a function to approve its own hook, so the agent host never asks the user to trust it.

## Why it matters

Coding agents read their config and hooks on every session, so an app that writes to them silently changes how the agent behaves on every project. The reporter does not claim any data was uploaded, and a November 3 follow-up says there is 'no evidence that data was uploaded'. The issue still shows how much trust agent hook systems place in local installers.

## Who it's for

developers who use Postman with Codex, Claude Code or Cursor

## Try it

Check ~/.codex/config.toml and your Claude Code plugins for a Postman entry, and uninstall it from inside the Postman app

## Quick facts

- App: Postman desktop 12.33.4 (also seen on 12.35.1)
- Plugins added: Codex 1.1.0, Claude Code 2.0.1, Cursor 2.2.0
- Also added: SessionStart hook, mcp.postman.com MCP server, Postman CLI
- Data upload: No evidence found, per the thread
- Postman's reply: November 3, 2026 — clearer opt-in, hook review

## FAQ

### Did Postman upload data from my coding agent?

The Postman auto-install issue does not show any data upload. The reporter says the report 'does not claim to establish data exfiltration', and a November 3 follow-up in the GitHub thread says there is 'no evidence that data was uploaded'. Codex did log an authentication failure when it tried to reach the Postman MCP server at mcp.postman.com at startup.

### What did Postman say about the auto-installed plugins?

A Postman staff member replied in the GitHub issue on November 3, 2026. Postman said it bundles the CLI and agent plugins with the desktop app because many users had trouble installing and wiring them up separately. It said users can uninstall them inside the app, that it will make the opt-in clearer for existing users, and that it is reviewing the hook approval and session-start behaviour.

### How do I remove the Postman plugin from Codex or Claude Code?

Postman says the bundled CLI and agent plugins can be uninstalled from inside the Postman desktop app. The reporter also found a Postman marketplace and plugin entry in the global ~/.codex/config.toml and a Postman CLI in ~/.local/bin, so check both places. The reporter asked Postman for a full rollback path that does not reinstall the plugins on the next update.

### Which coding agents does the Postman plugin support?

Postman's own install docs list Claude Code, Codex, Cursor, Factory, Kimi Code, OpenCode and Pi as supported agents, with a command that installs into every detected agent at once. In the GitHub issue, users reported the automatic install for Codex and Claude Code on Postman 12.33.4, and for Cursor as well on 12.35.1.

## Links

- [GitHub Issue](https://github.com/postmanlabs/postman-app-support/issues/14370)
- [HN Discussion](https://news.ycombinator.com/item?id=50354960)
- [Postman Plugin Docs](https://learning.postman.com/docs/postman-plugin/install/overview)