Postman silently auto-installs AI plugins and attempts to share all API data

Nov 3, 2026•sidgarimella•View Original

TL;DR Highlight

Opening Postman auto-installed plugins and a startup hook into Codex and Claude Code

Who Should Read

A developer using Codex or Claude Code who worries that desktop tools like Postman may change their agent configs

Core Mechanics

Just opening the app installed into two agents
- Postman's log shows source auto-existing-upgrade with claude-code:installed and codex:installed.
- The reporter says they only opened a Postman desktop app they hadn't used in a while.
Codex's global config was changed
- ~/.codex/config.toml gained a postman marketplace, an enabled plugin, and a hook trusted_hash.
- Claude Code's settings enabled the Postman plugin, and a Postman CLI landed in ~/.local/bin.
A SessionStart hook steers API work to Postman
- The hook prints instructions on startup, clear, and compact.
- They tell the agent to load the postman:api-engineer skill before most API tasks like design, testing, and docs.
The installer tries to approve its own hook
- In the source, codex.ts calls approvePostmanHook.
- codex-hooks.ts gets the hash via hooks/list and writes trusted_hash to hooks.state via config/batchWrite.
Remote MCP was enabled but failed auth
- mcp.codex.json points to https://mcp.postman.com/mcp.
- Codex logs show 'Auth required', causing repeated warnings.
Data exfiltration was not shown
- The reporter proved unwanted integration and instruction changes, not exfiltration.
- It was not reproduced on a clean Mac.

Community Reactions

Experience that Postman sends request contents to its servers
- A commenter said that using {{some_secret}} in a query parameter sends the real value to Postman's servers.
- Blocking that logging endpoint broke the app, and they found this while checking HIPAA compliance.
Healthcare team dropped Postman
- A commenter said their cyber team decertified Postman and everyone moved to Bruno overnight.
- Another said they would stop using it immediately and ask procurement for license refunds.
Opinion that this bypasses the agent trust model
- A commenter listed the hash bypass, prompt injection exposure, and silent remote MCP registration as problems.
- An issue comment tested that within one user account the trust record is just a config file a text editor can write.
Many alternatives were mentioned
- Commenters named Bruno, Insomnia, Yaak, Kreya, JetBrains' built-in REST client, and curl.
- One said Bruno has worked well because requests can be stored in git.

How to Apply

Check your agent configs for Postman traces today
- Look in ~/.codex/config.toml for marketplaces.postman, plugins."postman@postman", and hooks.state.
- Also check ~/.claude/settings.json, installed_plugins.json, and postman binaries in ~/.local/bin.
Watch agent config files for changes
- Keep config.toml and settings.json in git or backups and review diffs regularly.
- Remove any unknown hooks.state entries, plugins, or MCP servers right away.
Keep a team allowlist of hooks and MCP
- Document the SessionStart hooks and remote MCP URLs your team uses.
- Block or require approval for any MCP on an unlisted external domain.
Rethink how secrets enter API clients
- Move requests that use production secrets to a local or offline tool.
- Before adopting a tool, check its network calls and whether it requires an account.

Try It

copy & run

# Paste into Claude Code or Codex terminal: read-only audit prompt

Audit my home-directory agent configs in read-only mode. Do not modify any file.
- ~/.codex/config.toml
- ~/.claude/settings.json
- ~/.claude/plugins/installed_plugins.json
- ~/.local/bin

Look for: marketplaces, plugins, hooks.state (trusted_hash), SessionStart hooks, remote MCP server URLs, and installed CLI executables related to {{suspect keyword, e.g. postman}}.

Report as a table of file path, entry, and install time, and flag anything I may not have installed myself.

Next: decide which entries to remove yourself, delete them manually, then rerun the same audit to confirm.

Terminology

HookA command that runs automatically at certain moments, such as when an agent session starts. Think of it as an app's auto-run script.

trusted_hashA hash recording that the user trusts a given hook. It's like writing a badge number in the guest list ahead of time.

MCPA standard way for agents to connect to external tools and data. Think of it as a USB port for agents.

Plugin marketplaceA list of sources an agent downloads plugins from. It's like an app store's source address.

Related Resources

Postman silently auto-installs AI plugins and attempts to share all API data

Nov 3, 2026•sidgarimella•View Original

TL;DR Highlight

Opening Postman auto-installed plugins and a startup hook into Codex and Claude Code

Who Should Read

A developer using Codex or Claude Code who worries that desktop tools like Postman may change their agent configs

Core Mechanics

Just opening the app installed into two agents
- Postman's log shows source auto-existing-upgrade with claude-code:installed and codex:installed.
- The reporter says they only opened a Postman desktop app they hadn't used in a while.
Codex's global config was changed
- ~/.codex/config.toml gained a postman marketplace, an enabled plugin, and a hook trusted_hash.
- Claude Code's settings enabled the Postman plugin, and a Postman CLI landed in ~/.local/bin.
A SessionStart hook steers API work to Postman
- The hook prints instructions on startup, clear, and compact.
- They tell the agent to load the postman:api-engineer skill before most API tasks like design, testing, and docs.
The installer tries to approve its own hook
- In the source, codex.ts calls approvePostmanHook.
- codex-hooks.ts gets the hash via hooks/list and writes trusted_hash to hooks.state via config/batchWrite.
Remote MCP was enabled but failed auth
- mcp.codex.json points to https://mcp.postman.com/mcp.
- Codex logs show 'Auth required', causing repeated warnings.
Data exfiltration was not shown
- The reporter proved unwanted integration and instruction changes, not exfiltration.
- It was not reproduced on a clean Mac.

Community Reactions

Experience that Postman sends request contents to its servers
- A commenter said that using {{some_secret}} in a query parameter sends the real value to Postman's servers.
- Blocking that logging endpoint broke the app, and they found this while checking HIPAA compliance.
Healthcare team dropped Postman
- A commenter said their cyber team decertified Postman and everyone moved to Bruno overnight.
- Another said they would stop using it immediately and ask procurement for license refunds.
Opinion that this bypasses the agent trust model
- A commenter listed the hash bypass, prompt injection exposure, and silent remote MCP registration as problems.
- An issue comment tested that within one user account the trust record is just a config file a text editor can write.
Many alternatives were mentioned
- Commenters named Bruno, Insomnia, Yaak, Kreya, JetBrains' built-in REST client, and curl.
- One said Bruno has worked well because requests can be stored in git.

How to Apply

Check your agent configs for Postman traces today
- Look in ~/.codex/config.toml for marketplaces.postman, plugins."postman@postman", and hooks.state.
- Also check ~/.claude/settings.json, installed_plugins.json, and postman binaries in ~/.local/bin.
Watch agent config files for changes
- Keep config.toml and settings.json in git or backups and review diffs regularly.
- Remove any unknown hooks.state entries, plugins, or MCP servers right away.
Keep a team allowlist of hooks and MCP
- Document the SessionStart hooks and remote MCP URLs your team uses.
- Block or require approval for any MCP on an unlisted external domain.
Rethink how secrets enter API clients
- Move requests that use production secrets to a local or offline tool.
- Before adopting a tool, check its network calls and whether it requires an account.

Try It

copy & run

# Paste into Claude Code or Codex terminal: read-only audit prompt

Audit my home-directory agent configs in read-only mode. Do not modify any file.
- ~/.codex/config.toml
- ~/.claude/settings.json
- ~/.claude/plugins/installed_plugins.json
- ~/.local/bin

Look for: marketplaces, plugins, hooks.state (trusted_hash), SessionStart hooks, remote MCP server URLs, and installed CLI executables related to {{suspect keyword, e.g. postman}}.

Report as a table of file path, entry, and install time, and flag anything I may not have installed myself.

Next: decide which entries to remove yourself, delete them manually, then rerun the same audit to confirm.

Terminology

HookA command that runs automatically at certain moments, such as when an agent session starts. Think of it as an app's auto-run script.

trusted_hashA hash recording that the user trusts a given hook. It's like writing a badge number in the guest list ahead of time.

MCPA standard way for agents to connect to external tools and data. Think of it as a USB port for agents.

Plugin marketplaceA list of sources an agent downloads plugins from. It's like an app store's source address.

Postman silently auto-installs AI plugins and attempts to share all API data

TL;DR Highlight

Who Should Read

Core Mechanics

Community Reactions

How to Apply

Try It

Terminology

Related Papers

Related Resources

Postman silently auto-installs AI plugins and attempts to share all API data

TL;DR Highlight

Who Should Read

Core Mechanics

Community Reactions

How to Apply

Try It

Terminology

Related Papers

Related Resources