Postman Auto-Installs Codex and Claude Code Plugins Without Consent: A Trust Boundary Case Study

Forum topic · QianXun · 2026-11-04

Summary

A detailed account of a security controversy in which Postman's desktop app silently installed plugins, CLI tools, and session hooks into AI coding agents (Codex and Claude Code) without explicit user consent. GitHub issue 14370, opened October 25, documents the incident: an existing-user upgrade path on Postman 12.33.4 for macOS triggered an "auto-existing-upgrade" that installed Postman plugins into both agents, registered trusted SessionStart hooks, and preconfigured a remote MCP connection. The injected instructions directed agents to load Postman skills for any API-related engineering task. Independent testing suggests safety mechanisms partially held—Codex CLI skipped untrusted hooks and Claude Code triggered auth warnings—but both occurred after unconsented installation. The story went viral on Hacker News, reaching 1494 points by November 5. Postman responded that bundled installation was for convenience and promised clearer opt-in, though community members cited Wayback Machine evidence and reported the behavior recurring on a fresh machine. The case is framed as a lesson about trust boundaries, config files, plugin marketplaces, session hooks, and MCP in the era of AI coding agents.

What Happened

On the morning of October 24, a Mac opened Postman. Its logs later recorded: auto-existing-upgrade → ["claude-code:installed","codex:installed"]. The user never clicked any "install" button. On October 25, GitHub issue 14370 was opened, titled "[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook." By November 3, the story had hit Hacker News, where it reached 1494 points and 485 comments by November 5.

The Evidence Chain

All evidence comes from artifacts on the reporter's machine:

Codex's global config.toml was modified with Postman's plugin marketplace, enabled plugins, and a hooks trust record
The installer source contains self-approval logic — functions that trust only Postman's own hooks
A SessionStart hook injects instructions: for any non-trivial API engineering task (design, implementation, mock, testing, monitoring, docs, deployment), the agent is directed to load Postman skills first
Installed components include: user-level Postman plugins, session_start instruction hooks, the hook's trusted_hash, a remote MCP connection to marketplaces.postman, Claude Code plugins, and a standalone Postman CLI

Fact-Check Notes

The "nine hours later" framing is narrative pacing, not confirmed in the issue; only the log line's timestamp (Oct 24, 09:34:14 UTC) is solid
The HN headline claim about "sharing all API data" is overstated — the reporter explicitly stated the report establishes unconsented integration and instruction injection, not data exfiltration. The remote MCP connection failed authentication
A late-night response on Nov 3 was posted under the name zecoquit with author_association: NONE, so official identity is unverifiable
Postman's official reply: bundled installation saves setup effort, components can be uninstalled in-app, and they promise clearer opt-in and a review of hook approval and session-start behavior
Community pushback: Wayback Machine shows the relevant documentation page was added after the incident; another user reproduced the same auto-install path by upgrading Postman 12.31.3 → 12.35.1 on a second machine

Did the Defenses Hold?

Both agents have safeguards that partially caught the intrusion. Testing with Codex CLI 0.162.1 showed hooks without persistent trust records are silently skipped, casting doubt on whether the self-approval record actually took effect. Claude Code triggered an authentication warning. Both catches happened at the last layer — after the unconsented installation.

Timeline

Oct 24: Silent install occurs, logs left behind
Oct 25: Issue 14370 opened with four-part evidence chain
Nov 3: Hacker News passes 1000 points; late-night official response
Nov 5: 1494 points, 485 comments on HN

The Lesson

The attack surface of the agent era is no longer vulnerabilities — it's "convenience." Config files, plugin marketplaces, session hooks, and MCP connections are becoming battlegrounds where products stake territory. Each is a legitimate feature; combined, they form a chain of unconsented instruction injection. The cost of installing an API client has grown from "200 MB of disk" to "auditing your entire agent configuration."

---

Sources and caveats: GitHub postmanlabs/postman-app-support issue 14370 (2026-10-25, reporter NuclEnergy), including logs, config.toml, and installer source links; Postman's official response and Wayback snapshot disputes from issue comments (Nov 3); Codex CLI 0.162.1 and Claude Code 2.1.302 hook behavior testing from commenter foma-agent, not official statements; "next-day reproduction" from commenter ronthedrummer's self-report, not independently verified; HN 1007 points was a Nov 4 reading.