A report opened on October 25, 2026 on Postman’s GitHub repository describes how the desktop app installs AI coding-agent integrations during an update without asking for explicit confirmation. Comments, active through November 4, gather several matching accounts and a public response from the vendor on November 3.
A Report That Details a Silent Install
The reporter, user “indicava,” explains that on launching Postman 12.33.4 on macOS, the app enabled a Codex plugin and a Claude Code plugin, installed a separate Postman CLI, attempted a remote MCP connection that failed with an authentication error, and registered a startup hook that loads a Postman skill before any non-trivial API engineering task. The report calls this a “severe consent and trust-boundary problem,” while explicitly stating that no data exfiltration is established at this stage.
What Postman Changes Without Clearly Flagging It
Logs cited in the report show an auto-existing-upgrade entry recording the installation of both plugins. Codex’s config file gains a Postman marketplace entry, an enabled plugin entry, and a trust hash tied to the hook. A second report, dated November 3 and covering versions 12.31.3 through 12.35.1, confirms the same pattern on an existing install, Cursor included, though the trust hash wasn’t found there. One user also found Postman enabled in GitHub Copilot’s configuration, which the app’s built-in uninstall menu failed to remove.
{"results": ["claude-code:installed", "codex:installed"]}The Vendor’s Response on November 3
A comment presented as coming from Postman justifies bundling the CLI and agent plugins by citing the difficulty users had installing and wiring them up separately. The vendor says the bundling is disclosed on the download page and in the update flow, and that every component remains uninstallable from inside the app. It states it will “make the opt-in clearer, especially for existing users,” and is “reviewing the hook approval and session-start behavior.” No fix date is given, and several users push back that explicit consent should apply to everyone, not only existing installs.
| Installed component | Observed location | Reported effect |
|---|---|---|
| Codex plugin | ~/.codex/config.toml | Marketplace entry and plugin enabled automatically |
| Claude Code plugin | Agent plugin configuration | SessionStart hook loading a Postman skill |
| Postman CLI | Separately installed binary | Present even without explicit request |
| Copilot integration | ~/.copilot/settings.json | Persists despite uninstall via the in-app menu |
What It Means for Trust in Dev Tools
The episode illustrates a risk that has become common as coding agents spread: a startup hook or third-party plugin can change an agent’s behavior before a team even notices. The question echoes the issues already raised by the MCP specification, which governs exactly how a tool connects to an agent, and by the practices documented around running editorial agents in production, where tracing automatically loaded instructions has become its own audit criterion.
The report establishes an unconsented integration and instruction change; it does not establish data exfiltration.
~/.codex/config.toml, their agent’s plugin configuration, and ~/.copilot/settings.json after every app update — the built-in uninstall menu was not enough in at least one reported case.What to Remember
Postman acknowledges bundling AI agent integrations without making opt-in visible enough, particularly for already-installed accounts. The vendor promises adjustments to consent and hook trust, with no committed date. For now, manually checking configuration files is the only reliable safeguard for affected teams.
This kind of incident is becoming structural as dev tools ship agentic integrations by default. The real problem isn’t the plugin’s existence — it’s a startup hook that self-approves and changes an agent’s behavior without any explicit action being requested. Even without proof of exfiltration, a trust boundary crossed without consent deserves treatment as a security incident, not a poorly communicated convenience feature. — Simon Janvier
Going further: the detailed report on Postman’s GitHub repository.
