Postman Installs Plugins in Codex Without Consent
A single macOS report finds Postman's installer approved its own agent hook, a trust gap that has not been reproduced elsewhere.
Updated on Nov. 3, 2026 in Software
Live Poll
Would you be comfortable with apps adding tools to your AI coding assistant without asking?
A developer reported that installing the Postman desktop app (version 12.33.4 on macOS) automatically installed Postman plugins into Claude Code and OpenAI Codex without the user's permission. The report, filed October 25, 2025, documents one macOS installation and has not been independently reproduced on other systems, so the findings are a single-user account rather than a confirmed pattern.
Why it matters
The case shows how developer tools that extend AI coding agents can write configuration and trust settings that agents then act on, which raises questions about consent in agent plugin ecosystems. It surfaced after the developer saw Codex repeatedly load Postman skills and fail authentication against Postman's remote server.
The developer's inspection found an enabled Postman plugin and a new plugin marketplace in Codex's user configuration, an installed plugin in Claude Code's configuration, and a Postman CLI executable with matching timestamps. The evidence is one machine's local files and logs, not a measured rate or benchmark.
The players
Postman
An API development platform whose desktop app bundles plugins for AI coding agents such as Codex and Claude Code.
OpenAI Codex
OpenAI's coding agent, which reads user-level configuration and supports trusted session-start hooks.
Claude Code
Anthropic's coding agent, whose configuration showed an installed Postman plugin in the report.
The details
Postman's installer checks whether Codex already trusts a session-start hook and, if it does not, uses Codex's configuration batch-write call to add the hook's trusted hash, which tells Codex to run that script without prompting. Codex can then load Postman's API-engineer skill, a set of instructions the agent reads before handling most API development tasks. The developer reported that Codex began showing authentication errors against Postman's remote MCP server, a hosted tool endpoint that agents use to call external services, and repeatedly loaded Postman skills without being asked.
Timeline
October 24, 2025: Installation event marked auto-existing-upgrade occurred in Postman's logs.
October 25, 2025: The developer reported the issue on GitHub after Codex began showing authentication errors.
The Tech Race
The case sits in the competition among coding agents, Codex and Claude Code, to host third-party plugins and remote tool servers. Because both agents now read installed plugins and trust hooks from local configuration, how each handles consent for installers becomes a point of differentiation.
Developers who run Postman desktop alongside Codex or Claude Code on macOS may find plugins and trusted hooks already present in their agent configuration after an update. Users who want to check should inspect their Codex and Claude Code configuration files for Postman entries.
The takeaway
Watch whether Postman or OpenAI responds to the report and whether it is reproduced on other systems or versions. Developers who use coding agents can check their user configuration for unexpected plugin marketplaces and trusted session-start hooks.
Further reading
For broader context on how these tools are built and distributed, see the Software section.
Source note: This article includes information reported by The New Stack.
Live Poll
Would you be comfortable with apps adding tools to your AI coding assistant without asking?
