---
title: Postman's desktop app silently installed its plugins into Claude Code and Codex for existing users, added a startup hook telling agents to use Postman skills, and approved that hook itself | ctxsec
url: https://ctxsec.com/items/postman-desktop-auto-installs-claude-code-codex-plugins-self-approved-hook
description: "A GitHub issue opened Oct 25 shows Postman desktop 12.33.4 on macOS running an 'auto-existing-upgrade' step that installed Postman plugins into Codex and Claude Code, a remote MCP entry for mcp.postman.com, and a Postman CLI in ~/.local/bin. The Codex plugin adds a SessionStart hook whose text, marked EXTREMELY_IMPORTANT, tells the agent to load Postman's api-engineer skill before any non-trivial API task, and the installer writes a trusted hash for that hook so Codex never asks the user to approve it. A second user saw the same on 12.35.1, with a Cursor plugin too. A reply posted in Postman's name on Nov 3 says bundling was meant to simplify setup, that it is disclosed on the download page and update flow, and that Postman will make opt-in clearer and review the hook-approval behavior. The reporter does not claim data was exfiltrated."
status: "confirmed (GitHub issue 14370 with Postman's logs and installer source; Postman's reply in the thread, Nov 3, and Postman's plugin docs)"
published: 2026-11-04
---

> A GitHub issue opened Oct 25 shows Postman desktop 12.33.4 on macOS running an 'auto-existing-upgrade' step that installed Postman plugins into Codex and Claude Code, a remote MCP entry for mcp.postman.com, and a Postman CLI in ~/.local/bin. The Codex plugin adds a SessionStart hook whose text, marked EXTREMELY_IMPORTANT, tells the agent to load Postman's api-engineer skill before any non-trivial API task, and the installer writes a trusted hash for that hook so Codex never asks the user to approve it. A second user saw the same on 12.35.1, with a Cursor plugin too. A reply posted in Postman's name on Nov 3 says bundling was meant to simplify setup, that it is disclosed on the download page and update flow, and that Postman will make opt-in clearer and review the hook-approval behavior. The reporter does not claim data was exfiltrated.

[← Context & Harness Attacks](/context) · [markdown](/items/postman-desktop-auto-installs-claude-code-codex-plugins-self-approved-hook.md)

confirmed (GitHub issue 14370 with Postman's logs and installer source; Postman's reply in the thread, Nov 3, and Postman's plugin docs)

2026-11-04

### Postman's desktop app silently installed its plugins into Claude Code and Codex for existing users, added a startup hook telling agents to use Postman skills, and approved that hook itself

**Why it matters:** an unrelated desktop app changed another vendor's agent configuration and pre-trusted its own instructions, which is the same path a malicious installer would use to plant prompt-level persistence in a coding agent.

- **Check:** `~/.codex/config.toml` for a `postman` marketplace, `postman@postman` plugin and a `hooks.state` trusted entry; `~/.claude/settings.json` and `~/.claude/plugins/installed_plugins.json` for `postman@claude-plugins-official`; `~/.copilot/settings.json`; and `~/.local/bin/postman`.
- **Remove:** uninstall from within the Postman app or run `npx @postman/postman-plugin remove`, then re-check the files above.
- **Detect generally:** alert on writes to agent config and hook-trust files by any process other than the agent itself.

Sources: [GitHub: postman-app-support issue 14370](https://github.com/postmanlabs/postman-app-support/issues/14370) · [Idlen: Postman auto-installed plugins into Claude Code and Codex](https://www.idlen.io/news/postman-desktop-auto-installs-claude-code-codex-plugins/) · [The Terminal: Postman 12.33 agent plugins and self-approved hook](https://theterminal.space/software/postman-12-33-agent-plugins-self-approved-hook)