Postman Desktop Installed Its Own Plugins Into Codex and Claude Code and Tried to Trust Its Own Hook. Postman Is Reverting, So Check Your Config

Our verdict: if you run Postman's desktop app next to OpenAI Codex or Claude Code, audit your agent config files today. Postman's app wrote itself into both agents during an automatic upgrade, and the fix Postman announced only says it stops the change. It does not say it removes what is already on your disk. Neither coding agent did anything wrong, so our verdicts on them stand.

What happened

The report is GitHub issue #14370 on Postman's own support repository, opened on 25 October 2026 and titled "SEVERE Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook".

The reporter quotes Postman's own log: PostmanAgentPluginService~install: script completed, with the source auto-existing-upgrade and the results claude-code:installed and codex:installed. According to the report, the app then changed three places:

• ~/.codex/config.toml gained a [marketplaces.postman] git source, a [plugins."postman@postman"] block with enabled = true, and a hooks.state entry carrying a trusted_hash.
• ~/.claude/settings.json enabled postman@claude-plugins-official.
• A Postman CLI landed in ~/.local/bin.

The installed hook tells the agent, before "any non-trivial API engineering task", to "load the postman:api-engineer skill and follow it". That covers general API work, not only requests that mention Postman.

The installer's own source comment reads "Approves only Postman's current hook after installation". The reporter says the installer reads the hook's hash and writes it to hooks.state as a trusted_hash. In plain terms: the installer is built to answer, on your behalf, the approval step that should belong to you. The reporter is careful here too: the trust record on their machine "does not prove who created that specific record".

What Postman said

Postman's answers are issue comments, not a blog post or a security advisory. On 5 November 2026 a Postman account labelled Member, preethammavin, wrote that Postman will redesign the experience "with the right level of control" and that "in the meantime, we are reverting this change". The issue was closed and locked the same day.

The report was filed against Postman Desktop 12.33.4 on macOS, with Postman's Codex plugin 1.1.0 and Claude plugin 2.0.1. Postman has not said which other versions are affected or which release carries the revert. Postman's reply does not say whether the revert removes integrations that were already installed.

Why it matters

The reporter is careful about scope: the report "does not claim to establish data exfiltration", and we do not call this malware. It is a consent problem. A tool you installed for API testing changed how two coding agents behave, told them to load its skill first, and shipped installer code meant to approve its own startup hook, all without asking.

That is exactly the kind of change that is hard to spot: nothing breaks, your agent just starts following someone else's instructions. If you manage developer machines, treat ~/.codex/config.toml and ~/.claude/settings.json as configuration you audit, not files only the agent touches.

What changes for you

1. Open ~/.codex/config.toml and remove any [marketplaces.postman] source, the [plugins."postman@postman"] block and any Postman entry under hooks.state.
2. Open ~/.claude/settings.json and disable or remove postman@claude-plugins-official.
3. Check ~/.local/bin for a Postman CLI you did not install on purpose.
4. Update Postman desktop once the revert ships, then re-check both files, because Postman has not said the revert cleans old installs.

FAQ

Is this malware? No. The reporter explicitly does not claim data exfiltration. The problem is that the app changed your agents' behaviour without your consent, and its installer is written to approve its own hook.

Does Postman's revert fix my machine? Not as far as Postman has said. Its reply announces the revert but does not say it removes what was already installed, so clean the files yourself.

Does this change your verdict on Codex or Claude Code? No. Both tools were the target, not the cause.