TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A user’s GitHub report says opening Postman 12.33.4 on a Mac led to automatic installation of Postman integrations for Codex and Claude Code, changes to global agent settings, and a Postman CLI installation. The report documents a remote MCP connection that failed authentication, but provides no evidence that API data was sent or accessed.
A user says opening Postman 12.33.4 on a Mac automatically installed Postman integrations for Codex and Claude Code, changed Codex’s global configuration, and added instructions directing broad API work to Postman tools. The GitHub report includes application logs and installer source code, but does not establish that API data was transmitted or exfiltrated.
The report, filed in Postman’s public GitHub support tracker, says the user encountered recurring MCP authentication warnings in Codex and repeated Postman skill announcements after opening an existing desktop installation. Postman’s local log, as quoted in the report, records an “auto-existing-upgrade” operation on October 24, 2026, with the result “claude-code:installed” and “codex:installed.” The user says the investigation took place the following day.
The reported changes extended beyond the desktop app. The user found a Postman marketplace and enabled plugin entry in Codex’s global configuration, as well as a startup hook that instructs the agent to load a Postman API-engineering skill before responding to a wide range of API tasks. The report also describes a Postman plugin enabled in Claude Code and a separately installed Postman CLI. It identifies the desktop version as 12.33.4, the Codex plugin as 1.1.0, and the Claude plugin as 2.0.1.
The reporter links to Postman plugin source code showing that its Codex installer calls a function to approve the Postman hook after installation. The source comment says it “Approves only Postman’s current hook after installation.” The report cautions that the presence of a trust record alone does not show who created that record or prove a particular user action. Codex logs also showed that the configured remote MCP endpoint, mcp.postman.com, failed to start because authentication was required.
Changes Across Coding-Agent Settings
The concern raised is not simply that Postman offers plugins. It is that an application reportedly changed settings in separate coding-agent tools when the user opened an existing desktop app, without a clear, specific opt-in in those affected tools. Agent plugins and startup hooks can shape which instructions an assistant follows and which services it attempts to use, so users need to understand and control when those integrations are installed and trusted.
The report documents an attempt to connect to a remote MCP service and a broad instruction to route API work through Postman skills. It does not show that the connection authenticated, that the service received API content, or that data was copied out. The authentication failure in the reported logs is evidence of a failed startup, not proof of data access. That distinction matters: the consent and configuration issue described warrants scrutiny, while claims of data exfiltration are not supported by the material provided.
If the reported behavior is confirmed across other installations, it could affect developers who use Postman alongside AI coding tools and expect each tool to manage its own plugins and trust decisions. The account provided is a single-user observation, however, and does not establish how common the behavior is or whether it occurred under every upgrade path.
Products Worth Considering
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
What the Mac Investigation Found
The report describes a sequence in which the user opened an existing Postman desktop installation, then started Codex and saw MCP authentication failures and Postman skill announcements. The user inspected Postman logs, Codex configuration and hook files, plugin records for Claude Code, and the Postman installer’s source. Those materials support the reported installation and configuration changes on that Mac; the user says the sequence has not yet been reproduced on a clean Mac.
The evidence is specific to a signed-in user on macOS running Postman 12.33.4. Postman’s log labels the operation as an automatic installation for an existing user and reports successful installation results for Codex and Claude Code. The linked plugin files describe the startup hook and the installer’s hook-approval procedure. These are distinct pieces of evidence: the log records installation results, while the code shows what the installer is designed to do. Neither alone establishes that data left the user’s machine.
The issue was presented as a consent and trust-boundary concern, rather than as a confirmed breach. The reporter’s preferred remedy was to stop automatic installation of agent plugins and the CLI for existing desktop users until users explicitly opt in, and to remove installer-side approval of its own hook. Those are requests from the user, not changes Postman is confirmed to have made.
“auto-existing-upgrade”
— Postman local log quoted in the GitHub report
Scope and Data Access Remain Unknown
The available account does not show whether Postman has confirmed the behavior, whether the same automatic installation occurs for other users or versions, or whether the behavior is limited to a particular upgrade path or configuration. The reporter says the sequence has not been reproduced on a clean Mac, so the account is not an independent reproduction.
There is also no evidence in the supplied material that API data was transmitted to Postman or another service. The remote MCP connection reportedly failed with an authentication error, but that does not resolve whether other components made network requests, what information those requests contained, or whether any separate connection was active. The report does not include a packet capture or other evidence demonstrating data transfer. The source code and local logs should not be treated as proof of exfiltration.
It remains unclear whether users were shown a prompt, what consent or disclosure appeared during the installation, and whether Postman intended the integrations to be enabled for existing users by default. The report’s logs and inspected files provide detail about one machine, but the materials do not establish the company’s full product behavior or response.
Postman Response and Reproduction Needed
The next developments to watch are a response from Postman in the GitHub issue and an independent test of the reported upgrade sequence. A useful reproduction would document the app version, account state, relevant prompts, and resulting agent configuration on a clean system, while checking whether the behavior differs across versions.
Postman has not, in the material provided, confirmed the behavior or announced a change. The reporter asked the company to pause automatic agent-plugin and CLI installation for existing desktop users pending explicit opt-in, and to stop the installer from approving its own hook. Whether Postman adopts those requests, changes its installation flow, or provides further evidence about data handling remains unknown.
Key Questions
What did the user say Postman installed?
The report says Postman automatically installed plugins for Codex and Claude Code and separately installed a Postman CLI on one Mac. A Postman log quoted in the report records successful Codex and Claude Code installation results.
Did Postman send the user’s API data?
The supplied report does not establish that API data was sent or exfiltrated. It describes a configured remote MCP connection, but says Codex logged an authentication failure when trying to initialize it.
What was changed in Codex?
The user found a Postman marketplace entry and enabled plugin in Codex’s global settings, plus a startup hook instructing the agent to use a Postman API-engineering skill for a broad range of API tasks. The report also links to installer code that attempts to approve the Postman hook.
Has this been reproduced on other computers?
Not in the supplied material. The reporter says the observed sequence has not yet been reproduced on a clean Mac, and the report does not establish how many other users may be affected.
What is the reporter asking Postman to do?
The reporter asks Postman to stop automatic agent-plugin and CLI installation for existing desktop users until they explicitly opt in, and to remove installer-side approval of its own hook. The material does not say whether Postman has acted on those requests.
Source: github.com
