A developer reports that the Postman Claude Code plugin showed up on their Mac without being asked for, after they simply opened the Postman desktop app. The same update also set up a Postman plugin in OpenAI’s Codex. Here’s what was reported, what is still unproven, and how to check your own machine in about five minutes.
Postman hasn’t responded publicly yet, so treat this as one user’s report, not a confirmed bug.
Here are the facts worth knowing before you dig in.
- Reported on: Postman desktop 12.33.4, installed around October 24, 2026
- What appeared: a Postman plugin in Claude Code (v2.0.1) and in Codex (v1.1.0)
- Source: GitHub issue #14370, opened October 25 by one user
- Postman’s response: none visible as of November 3
- Reproduced on a clean Mac: not yet
The key point is consent. Nothing in the report shows data leaving the machine, but a desktop app changed the config files of two other tools you may trust with your code.
What the Postman Claude Code plugin reportedly did
According to the GitHub report, Postman’s own log labeled the install auto-existing-upgrade. That label suggests it ran as an upgrade for existing users, not as something you clicked.
In Claude Code, the report says the plugin postman@claude-plugins-official was switched on in ~/.claude/settings.json. In Codex, a Postman marketplace and plugin were added to ~/.codex/config.toml.
A Postman command-line tool also appeared in ~/.local/bin, with timestamps matching the same window.
Why the startup hook is the part to worry about
The Codex plugin registers a session-start hook. Every time Codex starts, it injects text telling the agent to load Postman’s API skill before any non-trivial API task.
That alone is a nudge, not an attack. The bigger issue is what the reporter found in Postman’s installer code: a function that approves Postman’s own hook in Codex’s trust list. Normally, you’d be the one to approve a hook.
A separate write-up on DEV Community says it checked that code at the pinned revision on November 3. It also notes that a remote Postman MCP connection was configured but failed with “Auth required,” and no API data was seen leaving the machine.
What is confirmed and what is not
Most of this rests on a single machine, so it helps to separate the solid parts from the open questions.
| Question | Status |
|---|---|
| Did the plugins install without a prompt? | Reported by one user, with logs |
| Did the installer approve its own hook? | Seen in the installer source code |
| Was any data sent out? | No evidence of it so far |
| Does it happen on every machine? | Unknown, not reproduced on a clean Mac |
| Are Cursor or other tools affected? | Unknown |
Until Postman explains which release or setting triggers this, don’t assume you are safe or affected. Check.
How to check and remove the Postman Claude Code plugin
Back up your config files first, then look in these four places.
- Open
~/.claude/settings.jsonand look forpostman@claude-plugins-official. Also check~/.claude/plugins/installed_plugins.json. - Open
~/.codex/config.tomland look for a Postman marketplace, apostman@postmanplugin, or hook trust entries. - List
~/.local/binand look for a Postman CLI you didn’t install. - Restart Claude Code and Codex, then confirm the Postman skill no longer loads.
If you find the entries and don’t want them, disable the plugin in Claude Code’s plugin menu, or delete the lines from the config files. Uninstalling the Postman app does not necessarily remove them, so clean them up separately.
If you’ve been burned by a tool extension before, our guide to the Claude Code extension backdoor check covers a similar audit. It’s also worth reading how built-in browsers in AI coding tools can be abused.
Why AI tool settings deserve the same care as passwords
Coding agents like Claude Code and Codex read your files, run commands, and can talk to outside services. A plugin or startup hook added to them gets a say in what the agent does next.
That’s why this report matters even if Postman’s intent was harmless. A trusted app changed another tool’s settings, and the change was easy to miss. Most people never open settings.json or config.toml.
A quick habit helps: after any big app update, glance at your agent config files for entries you don’t recognize. It takes a minute and catches this kind of surprise early.
Frequently Asked Questions
Did Postman steal my API data?
There’s no evidence of that. The remote connection reportedly failed authentication, and the main complaint is about consent, not theft.
Is my Mac the only platform affected?
The report came from a Mac, and the reporter hasn’t tested other systems. Windows and Linux users should still run the same checks.
Can I just uninstall Postman?
That may not be enough. The plugin entries live in your Claude Code and Codex config files, so remove them there too.
Will Postman fix this?
Nobody knows yet. The GitHub issue was still open with no maintainer reply when we checked. We’ll update this post if Postman responds.
Our take
Spend the five minutes now. Even if Postman turns out to be a one-off mistake, the habit of auditing your AI tool configs is worth building, because those files decide what your coding agent runs on startup. If you rely on Postman, keep the plugin only if you actually want it, and turn off automatic app updates until the company explains itself.
Leave a Reply