←Story detail

Trending story

Users report that the Postman desktop app automatically installs Codex and Claude plugins

1 reports1 story updatesUpdated Oct 26 03:03

Understand this story

AI overview

On October 24, 2026, a user filed an issue on GitHub, stating that after opening Postman desktop version 12.33.4, the logs recorded the automatic installation of the Codex plugin 1.1.0 and the Claude Code plugin 2.0.1, and that ~/.codex/config.toml and ~/.claude/settings.json were modified. The user also pointed out that the installed SessionStart hook requires the agent to load the postman:api-engineer skill before handling API engineering tasks, and that the installer source code calls approvePostmanHook in an attempt to write hook trust records on its own. The report also records that the Postman remote MCP failed to start because it requires authentication, and that the Postman CLI appeared in ~/.local/bin. The user said they have uninstalled the local installation and integrations and asked maintainers to handle the matter at critical priority. Currently there is only this one user report, and Postman has not yet issued a public response.

AI-generated from public reports

Latest development · Report

Postman Desktop Allegedly Auto-Installs Codex and Claude Plugins and Self-Approves Startup Hooks

Developments

1 confirmed developments

  1. Users report that Postman desktop version automatically installs Codex and Claude plugins

    Source:English text is being prepared.

Reports and discussion timeline

Browse reports and discussion by time. Their evidence levels remain distinct.

Oct 26

  1. Hacker News TrendingSelected

    Postman Desktop Allegedly Auto-Installs Codex and Claude Plugins and Self-Approves Startup Hooks

    A user filed an issue on GitHub, claiming that after opening Postman Desktop 12.33.4, its logs recorded the automatic installation of Codex plugin 1.1.0 and Claude Code plugin 2.0.1, along with modifications to ~/.codex/config.toml and ~/.claude/settings.json. The user also pointed out that the installed SessionStart hook requires the agent to load the postman:api-engineer skill before handling API engineering tasks, while the installer source code calls approvePostmanHook in an attempt to write hook trust records on its own. The report also documented that the Postman remote MCP failed to start because it requires authentication, and that a Postman CLI appeared in ~/.local/bin; the author stated that they had uninstalled the local installation and integrations and asked maintainers to handle the matter at critical priority.

Related stories

  1. Related storiesAnthropic unveils proactive AI agent Claude Duet
  2. Related storiesKimi official account releases Kimi K3.1 teaser video
  3. Related storiesCursor reports that a malicious Claude Code version has appeared in the marketplace
  4. Related storiesAnthropic releases Claude Opus 5.5