Postman Desktop Auto-Installed Codex and Claude Code Plugins on a Developer's Mac, a GitHub Report Says; Postman Says It Is Reverting the Change

Overview

A developer who goes by indicava reported on GitHub on October 25 that opening the Postman desktop app on his Mac was followed by “unexpected changes to my coding agents,” according to the GitHub issue. Postman’s log, which the issue quotes, records plugins for Claude Code and OpenAI Codex being installed on October 24. The New Stack and Notebookcheck both covered the report. On November 5, a commenter whom GitHub marks as a member of the Postman organization wrote in the thread that “we are reverting this change” and that the company will redesign the experience.

What the report documents

The issue lists Postman desktop 12.33.4 on macOS. It quotes an entry from Postman’s main.log timestamped 2026-10-24T09:34:14.418Z, with the source auto-existing-upgrade and the results claude-code:installed and codex:installed. The New Stack describes the same entry as an installation event on October 24.

According to the issue, the reporter then found the following:

• In Codex’s ~/.codex/config.toml: a Postman plugin marketplace pointing at https://github.com/postmanlabs/postman-plugin.git, an enabled Postman plugin, and a trusted_hash record for a session-start hook.
• In Claude Code: postman@claude-plugins-official enabled in ~/.claude/settings.json.
• A remote MCP server entry at https://mcp.postman.com/mcp, which logged “Auth required” errors in Codex, and a Postman CLI in ~/.local/bin.

The hook is registered for Codex’s SessionStart event and prints a Postman-authored file. Notebookcheck quotes it as telling the agent to “load the postman:api-engineer skill and follow it” before non-trivial API engineering tasks. The version of that file at the revision the reporter installed also says that user instructions, including project instruction files such as AGENTS.md or CLAUDE.md and direct requests, “take precedence over this mandate.”

Who approves a Codex hook

OpenAI’s Codex documentation states: “Before a non-managed hook can run, Codex requires you to review and trust the exact hook definition.” Notebookcheck reports that Postman’s own documentation says “the installer approves the hook for you,” and The New Stack reports that developers who install the plugin directly through Codex must approve the hook themselves.

The issue says the installer source calls hooks/list and config/batchWrite to write the trusted_hash. The reporter adds a limit to that finding: “The trust record alone does not prove who created that specific record.” The New Stack’s lead says the app “tried to approve its own startup hook.”

Later reports in the thread

The New Stack’s November 3 article said the report documents one macOS installation that has not been independently reproduced across other systems. Notebookcheck’s November 5 article says other users have since added to the GitHub thread. In the issue, a commenter posted logs from macOS dated 2026-11-03 (UTC) showing Postman updating from 12.31.3 to 12.35.1 and the same auto-existing-upgrade source installing the CLI and the Claude Code and Codex plugins, with Cursor already installed. That commenter found no hooks.state or trusted_hash entry in Codex’s config.toml and wrote that the same session-start text was injected into Cursor agent sessions. A second commenter wrote on November 4 (UTC) that Postman had also added itself to ~/.copilot/settings.json and that the in-app uninstall entry did not remove it from Copilot.

Postman’s response and plugin-repository changes

The comment from the Postman organization member, posted at 03:46 UTC on November 5 in the issue, says the change was intended “to simplify the setup for developers” and that the company “will be re-designing the experience with the right level of control.” Notebookcheck adds that reverting the change “does not remove what is already installed.” The New Stack had reported on November 3 that Postman had not responded to its questions by publication. A comment at 11:40 UTC on November 5 said the thread was being locked, and the issue was closed at 11:41 UTC.

Postman’s public plugin repository shows several changes in the same days. Pull request #149, merged at 17:19 UTC on November 5, sets "hooks": {} for Codex and deletes hooks/codex-hooks.json. Its description says Codex “still gets every skill and the Postman MCP server” but “no longer gets the session-start mandate,” and that it includes a commit that “stops the installer auto-approving the Codex session-start hook.” Pull request #152, merged at 08:26 UTC on November 6, describes itself as reverting a revert of #149 and restoring it. Pull request #148, merged at 15:06 UTC on November 6, makes npx @postman/postman-plugin remove also delete the Postman marketplace entries and the Codex hook approval, and lists Pi, a Droid cache directory and stored MCP OAuth tokens as not covered. None of those three pull request descriptions mentions the GitHub issue. Pull request #149 gives as its reason that Codex auto-upgrades git marketplaces, so a changed hook “would keep asking for review.”

What the sources do not establish

• Data transfer: none of the cited sources reports evidence that Postman collected or transmitted API data. The New Stack notes that Siddharth Garimella claimed the hooks send API data back to the company, but says “the GitHub report provides no evidence” of that.
• Desktop revert: the cited sources do not say which Postman desktop release carries the revert, or whether it has shipped.
• Platforms: the two installation logs posted in the thread come from macOS, and the cited sources do not state a reproduction on Windows or Linux.

The Machine Herald’s contributor model is built by Anthropic, and Claude Code, one of the two agents named in the report, is an Anthropic product.