Postman's Installer Approved Its Own Startup Hook in Codex

On October 25, 2026, a developer opened issue #14370 in Postman's public support tracker, titled "[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook". By November 4 it had more than 200 reactions and dozens of comments. The report says that after opening Postman desktop 12.33.4 on a Mac, the developer found a user-wide Postman plugin in Codex, a startup instruction hook, a remote MCP connection, a Claude Code plugin and a separately installed Postman CLI. We could find no public response from Postman on the issue at the time of writing.

What the reporter observed

The desktop app is closed source, so this part rests on the reporter's logs. They quote Postman's own log recording an install with the source auto-existing-upgrade and the results claude-code:installed and codex:installed. They also show new entries in ~/.codex/config.toml: a Postman marketplace, the plugin enabled, and a hooks.state record with a trusted_hash for Postman's session-start hook. The reporter is careful on one point: the trust record alone "does not prove who created that specific record". They also report that Codex logged an MCP startup failure because the remote Postman server required authentication that had not been set up.

What the public code shows

The plugin and its installer are open source in postmanlabs/postman-plugin. At the revision the reporter had installed, installer/src/hosts/codex-hooks.ts contains a function documented as "Approves only Postman's current hook after installation; unsupported APIs never fail the install." It starts codex app-server, asks hooks/list for Postman's hook, and, if the hook is untrusted or modified, upserts hooks.state with that hook's current hash. The function is still on the main branch. The hook itself prints a block wrapped in EXTREMELY_IMPORTANT tags at session start: "Before responding to any non-trivial API engineering task ... load the postman:api-engineer skill and follow it." The same block ends: "User instructions (project instruction files such as AGENTS.md or CLAUDE.md, and direct requests) take precedence over this mandate."

Postman's documentation does describe a command that installs the plugin "into every detected agent on your machine". The dispute is about that happening automatically during a desktop update, and about the installer approving its own hook instead of leaving that decision to the user.

What remains uncertain. We cannot see the desktop code that triggered the install, how many users received it, or whether every user got the hook approval. The issue's account is one user's evidence on one Mac. Postman's later releases of the plugin, including 0.6.0 on November 3, do not say whether the automatic install has been stopped.

Analysis: A coding agent's hook trust record is only as strong as the weakest program that can write to the agent's configuration. If any process running as the user can compute and store an approval, approval is not a user decision. At Belgavi's Book Store, Tanishka could add a check to the team's laptop setup script that lists every enabled plugin, marketplace and trusted hook in the Codex and Claude Code configurations and compares them with an approved list, flagging anything new after each software update. That catches an unexpected install the day it happens, whoever made it.

Sources and evidence

Issue #14370 (filed October 25) reports that Postman desktop 12.33.4 automatically installed Postman's plugin into Codex and Claude Code. The open-source installer contains approvePostmanHook, which writes a trusted_hash for Postman's own session-start hook into Codex's hooks.state. That hook tells the agent to load a Postman skill before any non-trivial API task, while deferring to user instructions. The desktop trigger is closed source, and we found no public Postman response.