Postman 12.33.4 auto-installs Codex and Claude Code plugins: how to check and remove

Postman's desktop app has been installing its own plugins into developers' AI coding tools, Codex and Claude Code among them, without asking first, according to a GitHub issue that drew more than 1,000 points on Hacker News on 3 November. A user reported that after opening Postman 12.33.4 on a Mac, the app had written a marketplace entry, an enabled plugin and a startup hook into their Codex and Claude Code settings, and that the installer tried to mark its own hook as trusted. Postman's staff have since replied in the thread. If you use Postman alongside an AI coding agent, you can check whether it happened to you in about a minute.

Key points

• The report is issue #14370 in Postman's support repository, opened on 25 October 2026 by a user who found changes dated 24 October after updating Postman desktop 12.33.4 on macOS.
• The reporter's log shows the install source as auto-existing-upgrade, meaning it ran for an existing user on app open, with results codex:installed and claude-code:installed.
• The plugin adds a session-start hook that tells the agent to load Postman's postman:api-engineer skill before any non-trivial API engineering task, not only when a user asks for Postman.
• A Postman staff member replied on 3 November that the components are bundled because many users had trouble installing them separately, that they can be uninstalled in the app, and that the team is "reviewing the hook approval and session-start behavior".
• The reporter says the evidence does not show that API data left the machine. The "shares all API data" wording in the Hacker News title goes further than the issue does.

What to do

Who may be affected: anyone who updated or opened the Postman desktop app (reports name 12.33.4, and a second user describes updating from 12.31.3 to 12.35.1 on macOS 26.5.2) and who also has Codex or Claude Code installed. A second reporter in the issue says Cursor was also affected. We could not reproduce this ourselves and Postman has not published a list of affected versions.

How to check. On macOS, run these in a terminal. They only read files:

grep -n -i postman ~/.codex/config.toml
grep -n -i postman ~/.claude/settings.json
grep -i postman ~/.claude/plugins/installed_plugins.json
ls -l ~/.local/bin | grep -i postman
grep -n "auto-existing-upgrade" "$HOME/Library/Application Support/Postman/logs/main.log"

These commands come from a write-up by the Neoteric blog. A match in ~/.codex/config.toml for a postman marketplace, a postman@postman plugin or a hooks.state block with a trusted_hash means the plugin is installed and its startup hook is trusted. The main.log line tells you whether the install came from the automatic upgrade path.

How to remove it. Postman says components can be uninstalled from inside the app. The issue does not contain a full, tested rollback, and the reporter asked Postman for one. Doing it by hand means editing the Postman entries in the two settings files above and removing the Postman CLI from ~/.local/bin. That is our reading of the reported file paths, not a procedure Postman has published, so back the files up first and review the diff rather than running an unknown script.

What happened

The reporter, posting as indicava, describes opening Postman desktop 12.33.4 on a Mac and later noticing changes in their AI tooling. Their main.log shows, at 09:34 UTC on 24 October, a line recording that the Postman agent plugin install script completed, with "source":"auto-existing-upgrade" and results codex:installed and claude-code:installed, followed by autoInstall.plugin.existing-user finished.

The changes the reporter lists:

• In ~/.codex/config.toml: a [marketplaces.postman] entry pointing to https://github.com/postmanlabs/postman-plugin.git, a [plugins."postman@postman"] block with enabled = true, and a hooks state entry for the plugin's session_start hook carrying trust hashes.
• In ~/.claude/settings.json: the plugin postman@claude-plugins-official enabled, with version 2.0.1 recorded in ~/.claude/plugins/installed_plugins.json on the same timestamp.
• A Postman executable and lib directory in ~/.local/bin.
• A remote MCP server definition pointing at https://mcp.postman.com/mcp. In the reporter's Codex log it failed to start with "Auth required, when send initialize request", so no session was established.

The hook is what makes the report "severe" in the reporter's title. It registers for the matcher startup|clear|compact, so it runs whenever the agent starts, clears or compacts its context, and prints a text file that instructs the agent to load the postman:api-engineer skill "before responding to any non-trivial API engineering task". Neoteric, which fetched the plugin source at the pinned revision on 3 November, describes the file as opening with an <EXTREMELY_IMPORTANT> block, with exemptions for pure questions and trivial one-line edits, and says user instructions in AGENTS.md or CLAUDE.md take precedence.

The reporter also points to the installer's source: a file named codex.ts calls an approvePostmanHook function after installing, which asks Codex for its hook list and writes a trusted_hash. A source comment says it "Approves only Postman's current hook after installation". The reporter's concern is that an installer recording trust itself bypasses the user's own approval of the hook. The reporter is careful here: the trust record in their config shows an approval attempt in the code, but does not by itself prove who created that entry on their machine.

Background

AI coding agents have grown a standard extension surface in the past year: plugins, skills, hooks and MCP servers. A hook that runs at session start can inject text into every conversation the agent has, which makes it a powerful place for a vendor to put instructions, and a sensitive one. Agent tools gate hooks behind a trust step, and tools that write to those settings files draw scrutiny.

API tooling vendors are racing to be the first thing an agent reaches for when a developer works on an API, which explains the incentive to bundle. Our earlier coverage of a backdoored Claude Code extension on the Cursor marketplace shows why developers are wary of anything that changes agent configuration unasked, although that incident involved malicious code and nothing in this report suggests malice by Postman.

How it works

The sequence the reporter and Neoteric describe is:

1. The Postman desktop app starts after an upgrade and checks whether the user is an existing user without the agent plugins.
2. It runs an installer script, logged as PostmanAgentPluginService~install, which adds the Postman marketplace and plugin to Codex and the plugin to Claude Code, and installs a Postman CLI.
3. For Codex, the installer asks the agent for its list of hooks and writes a trusted hash for Postman's session-start hook so the hook runs without a prompt.
4. On every later agent session, the hook prints its instructions, steering the agent toward the Postman skill for API work.

Another commenter, foma-agent, tested Codex CLI 0.162.1 and Claude Code 2.1.302 in scratch environments, without running Postman's installer. They report that Codex skips unrecorded hooks in non-interactive mode, that trust records can be computed and written by hand, and that changing a hook script's contents did not invalidate the record. That is a comment on how the trust mechanism behaves, not a finding about Postman, and we have not verified it.

What it means

For developers. The practical risk is the one the reporter names: a vendor's text sitting in your agent's startup context, trusted without a prompt. The instruction itself is aimed at promoting a Postman skill, but the same mechanism could carry anything. Treat hooks.state entries and enabled plugins as part of your audited configuration, the way you would treat shell profile changes.

For Postman. Its staff answer defends bundling as a convenience and promises a clearer opt-in "especially for existing users", which suggests the existing-user path is the part under review. Community members in the thread asked for opt-in for everyone and for a complete rollback guide.

For agent vendors. The reporter objects to a third-party installer approving its own hook. Whether Codex or Claude Code should refuse writes to trust state from outside the agent is a question the issue raises but does not answer.

On the "shares all API data" claim. The Hacker News title says Postman "attempts to share all API data". The issue's author says they do not claim data exfiltration, the Neoteric write-up says the same, and the only network evidence is an MCP connection that failed authentication. We do not repeat the claim. What is documented is an unrequested install, configuration changes and a startup instruction.

What we don't know yet

• Which versions and platforms. Reports cover macOS and Postman 12.33.4 and 12.35.1. Windows and Linux are untested in the thread.
• Whether it happens on a clean machine. Neoteric says the behaviour is not yet reproduced on a clean Mac.
• Who wrote the Codex trust entry. The code shows an approval attempt; a second reporter says their config.toml had no hooks state entry, so the outcome varies.
• Whether the downloads page changed. One commenter claims Postman edited its download page after the issue was filed, citing a web archive snapshot. Neither the commenter's claim nor Neoteric's reading of it is verified, and we have not checked it.
• Postman's fix. The company said it is reviewing the behaviour; it has not published a changelog entry we could find.

What to watch next

• A Postman release note or blog post changing the existing-user install path or the hook approval.
• A published, supported uninstall procedure covering agent configs, hook trust, marketplaces and the CLI.
• Responses from the Codex and Claude Code teams on third-party writes to hook trust state.
• Reports from Windows and Linux users, and from Cursor users, confirming or ruling out wider impact.

Sources

• postmanlabs/postman-app-support issue #14370 (GitHub), including the Postman staff reply of 3 November
• Neoteric: Audit ~/.codex/config.toml, Postman 12.33.4 added its own hook
• DEV Community: Postman installed itself into Codex and Claude