Postman Claude Code plugin installed without consent? The uproar

On October 25, a GitHub user going by indicava filed a report in Postman’s repository saying the Postman desktop app installed the Postman Claude Code plugin, plus a Codex plugin, on its own, and that the installer approved its own startup hook along the way. On November 3 the report hit the top of Hacker News with more than 400 points.

What actually happened?

The report is titled “[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook”. The author describes Postman Desktop 12.33.4 on a Mac and lists what they found on their machine:

1. The Postman plugin in Claude Code (postman@claude-plugins-official, version 2.0.1), enabled for the whole user.
2. The Postman plugin in Codex (version 1.1.0), together with a GitHub marketplace and a SessionStart hook already marked as trusted.
3. The Postman CLI in ~/.local/bin, with modification times matching the install window.
4. An entry for an MCP server at mcp.postman.com, which failed to start with an “Auth required” error.

The key evidence is the app log: on October 24 at 9:34 UTC, Postman recorded an auto-existing-upgrade event in which Claude Code and Codex have the status “installed”. The author says they never knowingly ran an install, and asks for opt-in consent, removal of the hook self-approval, the name of the flag that turned this on, and a complete rollback path.

What does Postman’s hook do in Claude Code and Codex?

The hook’s content is public in the postman-plugin repository. The file hooks/session-start-context.md is injected into the agent’s context at the start of every session and is wrapped in an <EXTREMELY_IMPORTANT> tag. It tells the agent to load the postman:api-engineer skill before answering “any non-trivial API engineering task”, so not only when we ask for something in Postman. Interestingly, the end of the file says user instructions, including CLAUDE.md and AGENTS.md, take precedence.

The second issue is trust. A new hook in Codex has to be approved, but the plugin README says plainly that installing into Codex auto-approves the Postman hook and that there is no separate prompt. In the installer code this is done by the approvePostmanHook function, which writes the hook’s trusted hash through codex app-server.

Is something wrong here?

The installer itself is no secret. According to Postman’s documentation, npx @postman/postman-plugin installs the plugin into every detected agent (including Claude Code, Codex, Cursor, GitHub Copilot CLI and OpenCode) and asks for confirmation unless we add the --yes flag. The problem is that, according to the report, the desktop app ran it during an update without asking anything.

Time for a reality check. The Hacker News title says Postman is “trying to share all API data”, but the report itself does not claim any data leaked. The author also notes they have not yet reproduced the full sequence on a clean Mac. At the time of writing there is no response from Postman in the GitHub thread, and the other comments are mostly reactions from other users (one says the script ran automatically for them after an update). So let’s treat the details with some caution until the company responds.

Why is this getting so much attention?

Because it touches something we are watching more and more closely: who adds what to our agents’ context. A plugin with a startup hook is an instruction the agent reads in every session, and a self-approved hook skips the one place where Codex asks a human for consent. In the HN comments some people add their own complaints about Postman, but those are opinions, not findings from the report.

I have already written about protecting your environment in the guide on AI agent security, and I explain what an agent and its harness are in what is an AI agent.

What to watch for from now on?

If you have Postman Desktop installed, it is worth checking a few places (the report’s author lists the same files):

1. In Claude Code, the plugin list in ~/.claude/plugins/installed_plugins.json and ~/.claude/settings.json.
2. In Codex, the ~/.codex/config.toml file, including trusted hooks.
3. The ~/.local/bin directory, to see whether the Postman CLI showed up there.

The installer also has status (what is installed) and remove (uninstall from all detected agents) commands, described in the README. (According to the documentation, the --dry-run flag shows what remove will change before it deletes anything.) A general rule: every now and then, review which plugins, hooks and MCP servers your agent has attached.

FAQ

Does Postman send my API data to the cloud through the plugin?

The GitHub report does not say so. The author notes they found no data leak, and the only external addresses they list are the plugin repository on GitHub and the mcp.postman.com MCP server, which did not start on their machine.

Is the Postman Claude Code plugin official?

Yes. Postman is listed in Anthropic’s official marketplace as postman@claude-plugins-official. The dispute is not about the plugin itself, but about the claim that it landed on a computer without the user’s consent.

How do I remove the Postman plugin from Claude Code and Codex?

According to the README, npx @postman/postman-plugin remove is enough, and the --agent <id> flag limits the change to a single agent. The report’s author still asks Postman for complete rollback instructions, including trusted hooks and the cache, because none exist yet.