Postman says it is reverting a change that quietly turned its desktop app into an uninvited guest inside the two biggest AI coding agents. An update to Postman 12.33.4 installed plugins into Claude Code and OpenAI Codex on October 24 without asking, added a marketplace and a startup hook the installer approved itself, and left users discovering the changes only when their agents started routing API work through Postman.
## What the Update Did
The evidence comes from Postman’s own logs. On one developer’s Mac, the log records an ‘auto-existing-upgrade’ at 09:34 UTC on October 24, with the result ‘claude-code:installed, codex:installed.’ Codex’s configuration then contained a new Postman plugin marketplace, an enabled Postman plugin, and an approval for a startup hook — the kind of trust decision that is normally the user’s to make.
The hook itself is the sharp part. It runs at the start of every Codex session and tells the agent to load Postman’s api-engineer skill for any non-trivial API task. Postman’s own documentation states that ‘the installer approves the hook for you.’ A Postman MCP connection was added too, though it kept failing with an ‘Auth required’ error.
## How Users Found Out
The developer who found it, posting as indicava, filed a report in Postman’s public GitHub issue tracker on October 25, calling it a severe consent and trust-boundary problem. A second user reproduced it on November 3, when Postman updated to 12.35.1, and the startup text had reached Cursor as well. Another user found Postman entries in the GitHub Copilot CLI.
All reported cases so far involve Macs, and there is no evidence Postman collected any data this way. The original report says so itself, and The New Stack found nothing to suggest otherwise. That distinction matters: this is a story about consent and control, not about spying, and Postman’s response has treated it that way.
## Postman’s Response
Postman’s first reply, on November 3, said the bundle was meant to ease setup and that the company would make the opt-in clearer. On November 5, a Postman staff member went further in the same thread, saying the company ‘will be re-designing the experience with the right level of control’ and adding: ‘In the meantime, we are reverting this change.’
Reverting the change does not remove what is already installed. Users can uninstall the coding-agent plugin from the Help menu, under Postman CLI and Plugins, or run npx @postman/postman-plugin remove. One user reported that the Copilot CLI entry remained even after using the menu option, so checking the config files by hand is still the safe move.
## Our Read
The technical details are almost beside the point. What matters is the boundary Postman crossed: an app reached into other people’s tools and changed them, then approved its own instructions. Coding agents are becoming where developers work — [Cursor now turns prompts into live, shareable apps](https://geroundtable.com/cursor-live-apps-shareable-link/) — so whoever controls an agent’s startup instructions controls what it reaches for first.
Postman deserves credit for the speed of the reversal, and for saying so in the open thread where users found the problem. But agents are a new attack surface, and the last one caught out was a [fake Claude Code update that planted a backdoor in Cursor](https://geroundtable.com/claude-code-cursor-backdoor/). This time the intruder was a legitimate vendor.
## Why It Matters
Developers hand coding agents the keys to their repositories, their cloud accounts, and their production systems. That trust only works if nothing else can quietly rewrite what an agent does when it starts up. Postman’s installer did exactly that, at scale, to anyone who opened the app.
The fix is a revert, but the lesson is a design rule: installation into another tool must always be an explicit opt-in, never a side effect of opening an app. Every vendor shipping agent plugins should be reading this thread and checking its own installer before users do it for them.
## Background
Postman is one of the most widely used API platforms in software development, and its plugins for Claude Code and Codex let developers test APIs without leaving their agent. The company had already been bundling the CLI and plugins with the desktop app; the dispute is not about the plugins existing, but about them arriving unannounced and approving their instructions.
Source: [Notebookcheck’s report](https://www.notebookcheck.net/Postman-added-itself-to-Claude-Code-and-Codex-without-asking.1442933.0.html) and [Postman’s GitHub thread](https://github.com/postmanlabs/postman-app-support/issues/14370)
0 Comments