Postman added itself to Claude Code and Codex without asking

If you use Postman to test APIs and also run an AI coding agent, check that agent's settings. An update to the Postman desktop app added Postman to Claude Code and OpenAI Codex without asking the user. A developer who goes by indicava described it in a detailed GitHub report on October 25. According to the logs on his Mac, Postman 12.33.4 automatically installed plugins for both agents on October 24, along with its own command-line tool.

What Postman changed

Codex's configuration file then contained a new Postman plugin marketplace, the enabled Postman plugin and an approval for a startup hook. Postman's own documentation states that "the installer approves the hook for you." In Codex, that approval is normally the user's decision. The hook runs at the start of every session and tells the agent: "Before responding to any non-trivial API engineering task ... load the postman:api-engineer skill and follow it." Postman also added a connection to its MCP server, which kept failing to start with an "Auth required" error because the user was not signed in. In Claude Code, Postman enabled its own plugin in the settings file.

Other users have since added to the GitHub thread. One saw the same thing on November 3 when Postman updated to 12.35.1, and in his case the startup text also reached Cursor. Another found Postman in the GitHub Copilot CLI. All reported cases so far involve Macs. There is no evidence that Postman collected data this way. The original report says so itself, and The New Stack found nothing to suggest otherwise.

Postman is reverting the change

Postman's download page now says that "the Postman app includes Postman CLI & Postman plugins." One user points out that this sentence was missing from an archived copy of the page dated October 26. On November 5, a Postman staff member replied in the thread. The company had wanted to make setup easier and "will be re-designing the experience with the right level of control," he wrote, adding: "In the meantime, we are reverting this change." Reverting the change does not remove what is already installed.

How to remove the entries

In the Postman app, the Help menu has an option under Postman CLI and Plugins to uninstall the coding agent plugin. One user says the Copilot CLI entry remained after using it. If Node.js is installed, Postman says the command npx @postman/postman-plugin status lists the agents it detects and shows where the plugin is installed. Running it with remove instead of status uninstalls the plugin. It still makes sense to check the files yourself. They are in your home folder. For Claude Code, look in settings.json in the .claude folder for the entry postman@claude-plugins-official, and in installed_plugins.json in the plugins subfolder. For Codex, everything is in config.toml in the .codex folder, where you should look for sections with postman in their names. For the Copilot CLI, check the .copilot folder. The command-line tool is installed in .local/bin. Our report on a tampered Claude Code extension in Cursor has more tips on spotting extensions you did not install. Our report on fake ChatGPT and Claude desktop apps shows how attackers use AI tools as cover.