Understand this story
On October 24, 2026, a user filed an issue on GitHub, stating that after opening Postman desktop version 12.33.4, the logs recorded the automatic installation of the Codex plugin 1.1.0 and the Claude Code plugin 2.0.1, and that ~/.codex/config.toml and ~/.claude/settings.json were modified. The user also pointed out that the installed SessionStart hook requires the agent to load the postman:api-engineer skill before handling API engineering tasks, and that the installer source code calls approvePostmanHook in an attempt to write hook trust records on its own. The report also records that the Postman remote MCP failed to start because it requires authentication, and that the Postman CLI appeared in ~/.local/bin. The user said they have uninstalled the local installation and integrations and asked maintainers to handle the matter at critical priority. Currently there is only this one user report, and Postman has not yet issued a public response.
AI-generated from public reports
Latest development · Report
Postman Desktop Allegedly Auto-Installs Codex and Claude Plugins and Self-Approves Startup HooksDevelopments
1 confirmed developments
Users report that Postman desktop version automatically installs Codex and Claude plugins
Source:English text is being prepared.
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 26
Hacker News TrendingSelected
Postman Desktop Allegedly Auto-Installs Codex and Claude Plugins and Self-Approves Startup Hooks
A user filed an issue on GitHub, claiming that after opening Postman Desktop 12.33.4, its logs recorded the automatic installation of Codex plugin 1.1.0 and Claude Code plugin 2.0.1, along with modifications to ~/.codex/config.toml and ~/.claude/settings.json. The user also pointed out that the installed SessionStart hook requires the agent to load the postman:api-engineer skill before handling API engineering tasks, while the installer source code calls approvePostmanHook in an attempt to write hook trust records on its own. The report also documented that the Postman remote MCP failed to start because it requires authentication, and that a Postman CLI appeared in ~/.local/bin; the author stated that they had uninstalled the local installation and integrations and asked maintainers to handle the matter at critical priority.