What happened
On October 25, 2026 GitHub user indicava opened issue 14370 in the postmanlabs/postman-app-support repository, titled "[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook". The report covers Postman desktop 12.33.4 and Codex Postman plugin 1.1.0.
According to a Postman log quoted in the issue, a plugin install script completed on October 24 with Claude Code and Codex both marked installed and the source given as "auto-existing-upgrade". A Hacker News discussion of the issue opened on November 3.
What the plugins change
The reporter says the installed Codex hooks register a session-start command that prints an instruction: "Before responding to any non-trivial API engineering task ... load the postman:api-engineer skill and follow it." That is broader than a user asking to use Postman, and it explains repeated Postman skill announcements in agent sessions.
The reporter limits the claim: "This report establishes unwanted integration and instruction changes; it does not claim to establish data exfiltration." Other commenters make further claims about Postman's behaviour; those are unverified and not repeated here.
The reply in the thread
On November 3 at 23:36 UTC, the GitHub account zecoquit replied in the thread, writing as "we". GitHub does not show that account as linked to Postman, and Postman has not published a separate statement that we found. The reply says "we bundle the Postman CLI and the agent plugins with the desktop app because many users had trouble installing and wiring them up separately" and: "We mention this on the download page and in the app update flow, and you can uninstall any of these components from inside the app." It adds: "We're going to make the opt-in clearer, especially for existing users, and we're reviewing the hook approval and session-start behavior you flagged."
What it means for you
If Postman Desktop runs on a machine where you use Codex or Claude Code, list the plugins and hooks each agent loads and remove the Postman ones you did not choose, either in Postman or in the agent's plugin settings. Treat any tool that writes into your agent configuration like a dependency update: review what it adds before it runs in your sessions.
Go to the source
Sources & further reading
Based on the official documentation below. Features and access can change; check the provider before making a decision.
Was this page useful?
Help us make our coverage more useful. This is feedback on the page, not a rating of the tool.
Go a little further