Developer claims Postman installed plugins into Claude Code and Codex without permission

A developer known as “indicava” on GitHub reported that opening the Postman desktop application version 12.33.4 on macOS caused plugins to install into Claude Code and OpenAI Codex without their consent. The app also attempted to approve its own startup hook, which instructs Codex to automatically use Postman’s tools for API development tasks.

The developer first noticed the issue after Codex began displaying authentication errors and repeatedly loading Postman skills without being asked. They filed a report on October 25 on GitHub, noting that they had not explicitly authorized these changes to their coding environment.

Plugins installed silently

Postman’s application logs, shared in the GitHub issue, show an installation event on October 24 marked as "auto-existing-upgrade." The results of this process indicate that plugins for both Claude Code and Codex were installed automatically.

The developer discovered modifications to Codex's user-level configuration file ~/.codex/config.toml. These changes included enabling a Postman plugin, creating a new plugin marketplace entry, and adding a trusted session-start hook.

The report also found a Postman CLI executable on the machine, with timestamps matching the installation.

Similar unauthorized changes were found in Claude Code’s configuration, including an installed Postman plugin and a matching Postman CLI executable with corresponding installation timestamps.

The developer noted that this behavior was documented as one specific macOS installation case and has not been independently reproduced across other systems.

The self-approving startup hook

A significant concern raised by the report is how Postman manages to get Codex to trust its plugin automatically. According to Postman’s own documentation on detected agents, its installer is designed to automatically approve a session-start hook on the user's behalf.

According to Postman’s own documentation, its installer can automatically approve a session-start hook on the user’s behalf.

In contrast, developers who install the plugin directly through Codex must manually review and approve the startup hook themselves. The installer’s source code reveals the mechanism used when automatic approval is attempted.

The installer checks whether Codex already trusts the hook. If it does not, the script uses config/batchWrite to add the hook’s trusted hash to Codex's configuration. It verifies that the hook has not changed before approving it and logs a message instructing the developer to review the hook if approval fails or cannot be confirmed.

Session-start hooks allow coding agents to receive instructions automatically, even when the developer has not requested them. Postman’s startup instructions tell Codex to load the postman:api-engineer skill before handling most API development tasks.

While Codex is still intended to follow the developer’s primary instructions first, it is also being told by default to use Postman's tools for many API tasks, regardless of whether the user asked for them.

Developers raise security concerns

The findings have sparked criticism from developers on GitHub and X regarding the lack of transparency and consent in these integrations. Security researcher Frank Denis called the integrations "junk" on X, pointing out that Postman’s installer attempts to trust its own startup hook automatically.

Siddharth Garimella went further, claiming that Postman's hooks intercept API data and send it back to the company. However, the GitHub report provides no evidence that Postman collected or transmitted any API data; it only documents changes to agent settings and a remote MCP connection.

The developer also found that Postman had configured a connection to its remote MCP server at ` but Codex repeatedly failed to authenticate with this endpoint.

Criticism has spread across platforms, with one GitHub commenter describing the behavior as "unacceptable, even creating risk in corporate environment." Another user urged Postman to be transparent and explicitly ask for permission before making such changes.

Who controls the agent

The developer is requesting that Postman stop installing plugins for existing users without their permission and leave hook approval entirely up to Codex. They also want a method to fully undo all the changes made by the unauthorized installation.

While Postman provides an uninstall command, the developer argues this is insufficient because removing the integration should also clear any changes to agent settings, trusted hooks, MCP connections, and installed CLI tools.

For now, developers can check their Claude Code and Codex settings for unfamiliar plugins, hooks, or MCP connections. The complaint comes as the community pushes for more control over coding agents.

Postman’s installer can approve its own Codex hook without the usual manual review.

What remains unanswered is why an existing desktop installation reportedly triggered this process without the user's permission.