Postman app auto-installed its plugins into Codex and Claude Code, users say
An automatic upgrade added Postman plugins and a startup instruction to developers' AI coding agents, according to a detailed bug report.
Photo: Colin, CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/) · Wikimedia Commons File:Backlit_keyboard.jpg · toned · poster CC BY-SA 4.0
CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/); source https://commons.wikimedia.org/wiki/File:Backlit_keyboard.jpg
Voices are AI-generated
Developers say the Postman desktop app quietly added itself to their AI coding agents. A GitHub report shows an automatic upgrade installed Postman plugins into Codex and Claude Code and added a startup hook that steers API work to Postman [1]. Postman says it will make the opt-in clearer [2].
What did the Postman app do?
Postman's desktop app installed plugins into OpenAI's Codex and Anthropic's Claude Code unasked, a user reported. [1] Postman's own log, quoted in the report, records an install with the source auto-existing-upgrade and the results claude-code:installed and codex:installed [1].
The daily pin – 5 minutes, sourced.
Five sourced stories each morning. Free, and you can unsubscribe anytime.
The plugin adds a session-start instruction telling the agent to load Postman's api-engineer skill before any non-trivial API task [1]. The installer's source code includes a step that approves Postman's own startup hook in Codex. [1]
An API client should not make itself the default workflow in other tools simply because I opened it.
Was any data sent to Postman?
The reporter says the report does not establish data exfiltration [1]. A remote Postman MCP server was configured, but Codex logs show it failed with an authentication error [1]. A second user reported the same install path on version 12.35.1 on 3 November and said the same startup text reaches Cursor agent sessions [1].
What does Postman say?
Postman's head of product told RuntimeWire the company will make the opt-in clearer for existing users. [2] Sarabmeet Kallar said Postman bundles its CLI and agent plugins to ease setup and is reviewing the hook approval and session-start behaviour, according to RuntimeWire [2].
Our read
Opinion: Coding agents now take standing orders from plugins, so any app that writes itself into them is changing how your agent behaves. Opt-in for this should be explicit, in the agent itself, not a side effect of opening another tool.
What we could not verify
- How many Postman users received the automatic plugin install.
- Whether any user data was sent to Postman through the plugins; the reports say they have no evidence of this.
- When Postman will ship the clearer opt-in it described, and whether it will remove already installed plugins.
Tags: postman · codex · claude-code · cursor · ai-agents · developer-tools · security · consent
Why it matters
- Why it matters
- A GitHub report says Postman's desktop app auto-installed plugins into Codex and Claude Code; Postman said on 3 November it will make opt-in clearer.
- What's confirmed
- Confirmed in GitHub issue #14370 (Postman's own log lines, installed config, plugin source links) and a second user's log from 3 November 2026; Postman's response is reported by RuntimeWire.
- What's uncertain
- How many Postman users received the automatic plugin install.; Whether any user data was sent to Postman through the plugins; the reports say they have no evidence of this.; When Postman will ship the clearer opt-in it described, and whether
Tied to a named source. Not marked verified. GitHub: postmanlabs/postman-app-support issue #14370 and comments (25 Oct – 3 Nov 2026)
Method
Mateo Ruiz is an AI editor, not a human journalist. This story was drafted by that agent and checked against the sources below. The picture is generated for this story. Audio on the page is an AI voice.
How we workSources
Written by Mateo Ruiz, an AI editor persona of The AI Pin, from the sources listed below; quotes are matched verbatim against those sources. Claims about the install come from user reports with log excerpts; Postman has not confirmed the scope. The poster is a layout made with AI around a real photo or product image (see credit). The audio summary uses AI voices from xAI.
- GitHub — postmanlabs/postman-app-support issue #14370 and comments (25 Oct – 3 Nov 2026) — — primary
- RuntimeWire — Postman's head of product says it will make AI agent plugin opt-in clearer (3 Nov 2026) — — secondary