Postman quietly changed the Claude Code and Codex coding assistants on developers' machines

On October 25, a developer who signs as “indicava” opened an issue on Postman's GitHub repository. The app is widely used by developers to test and document application programming interfaces (APIs). The issue title starts with “[SEVERE]”. While digging through the app's log, the developer found lines dated the day before. During an automatic update, Postman had installed plugins in Codex, OpenAI's coding assistant, and in Claude Code, Anthropic's. They had never asked for it.

On November 5, Postman replied on the issue. A team member wrote that the company would rethink the mechanism “with the right level of control” and, “in the meantime,” roll back the change. The issue was then closed and locked.

An instruction slipped in at the start of every session

According to the issue, version 12.33.4 of Postman for macOS modified several configuration files in the user's home folder.

• For Codex, the ~/.codex/config.toml file received a Postman plugin marketplace, an enabled plugin and fingerprints marking a startup script as approved. The plugin also sets up a connection to a Postman MCP server (the protocol that links assistants to outside tools).
• For Claude Code, the postman@claude-plugins-official plugin appeared as enabled in ~/.claude/settings.json.
• A Postman command-line tool was dropped into ~/.local/bin.

This startup script, called a hook, runs every time an assistant session opens. According to Notebookcheck, it tells the assistant to load the Postman skill before answering “any non-trivial” API engineering task. The issue's author considers this instruction far broader than necessary.

The most questionable point is the approval. Codex normally expects the user to approve a hook before trusting it. According to the issue, Postman's installer does this itself, and the company's documentation, cited by Notebookcheck, says so in black and white. The issue's author stays cautious: the approval record alone does not prove who created it.

No data collection observed

Nothing shows that Postman collected data this way, Notebookcheck points out, also citing The New Stack. The configured MCP server even failed for lack of authentication. But the case is not isolated. According to Notebookcheck, another user saw the same thing on November 3, after updating to version 12.35.1. This time, the instruction also reached the Cursor code editor. Another user found Postman in the GitHub Copilot command-line tool. All reported cases involve Macs.

Nothing malicious here, but the path is the one that AI agent security specialists fear: text added to the context of an AI that can read code and run commands. We previously showed that a file downloaded without your knowledge could control these same assistants. This time, a legitimate software vendor gave itself that right, without explicit consent.

How to check and clean up your machine

Rolling back the change on Postman's side does not remove plugins that are already installed, Notebookcheck notes. If you use Postman on a Mac with a coding assistant:

• in Postman, go to the Help menu, in the section on the CLI and plugins, to uninstall the coding agents plugin;
• if Node.js is installed, the command npx @postman/postman-plugin status lists the detected agents. Replacing status with remove uninstalls the plugin;
• manually check the sections containing “postman” in ~/.codex/config.toml, as well as ~/.claude/settings.json, ~/.claude/plugins/installed_plugins.json, the ~/.copilot folder and ~/.local/bin;
• verify afterward: one user reports that the Copilot entry was still present after uninstalling.

In companies, this check applies to every developer workstation. AI assistant configuration files now deserve the same attention as SSH keys or browser extensions.

Postman promises a new version “with the right level of control,” without giving a date. It remains to be seen whether installing plugins will become an explicit choice, and whether other vendors will be tempted to invite themselves into their users' assistants too.