Postman reportedly auto-installed AI agent plugins and hooks in Codex and Claude Code
Overview
A user reports that opening Postman desktop 12.33.4 automatically installed Codex and Claude Code plugins, enabled a remote Postman MCP connection, and added a session-start hook that routes API tasks to Postman skills.
The report cites Postman's own log entries and the plugin's installer source, which attempts to approve its own hook. The user says the installs happened without clear consent and asks Postman to add opt-in and a full rollback path. The report does not claim data was exfiltrated.
Written by AI from the articles below · updated Nov 3, 1:29 PM ET
Check the sources:
Article timeline
The articles in this story. Times are ET.
- Hacker News · AI (150+ points)BlogPostman's installer reportedly added AI agent plugins and hooks without clear user consent
AIA user reports that opening Postman desktop 12.33.4 automatically installed Codex and Claude Code plugins, enabled a remote Postman MCP connection, and added a session-start hook that routes API tasks to Postman skills. The report cites Postman's own log entries and the plugin's installer source, which attempts to approve its own hook. The user calls this a severe consent and trust-boundary problem and asks Postman to add opt-in and a full rollback path. The report does not claim data exfiltration.
Heat Trend
Not enough continuous observations to show a trend yet.