GitHub issue 14370 filed October 25, 2026; install logged October 24, 2026; independent reproduction reported November 3, 2026
Postman Opened, and Two AI Coding Agents Got New Plugins: The Consent Failure, and What the Logs Do Not Prove
Opening Postman on a signed-in Mac did more than open Postman, according to GitHub issue 14370 and two independent reviews of the evidence. Postman desktop 12.33.4 recorded an auto-existing-upgrade step in its own log on October 24, with results showing plugins installed into Anthropic's Claude Code and OpenAI's Codex without an explicit install request. On that machine, the Codex configuration gained a Postman marketplace entry and an enabled plugin, a Postman CLI landed in the local bin folder, and the installer wrote a trust record for its own SessionStart hook: a function named approvePostmanHook approves the hook on the user's behalf. The hook itself instructs the agent to load Postman's API-engineering skill before any non-trivial API task, so it steers future agent sessions, not just Postman sessions. What the evidence does not show matters just as much. The plugin configures a remote MCP connection to Postman's servers, but the reporter's logs show that connection failing authentication, the reporter does not claim data exfiltration, and a second user who reproduced the auto-install on November 3 while upgrading from 12.31.3 to 12.35.1 reported no evidence that data was uploaded. Postman says the bundle is meant to ease setup, is mentioned on the download page and in the update flow, and can be uninstalled in the app, and that it will make the opt-in clearer, especially for existing users, and is reviewing the hook approval behavior.
Executives
No breach has been proven here, and the story is still a governance finding. A routine desktop update reached into two other products, changed how AI agents on the machine behave, and approved its own permission to do so. That is the pattern to govern wherever agents are in use: which vendors can write into agent configurations, who approves hooks and plugins, and how would you know. Under the NIST AI RMF this is Manage work, and under ISO/IEC 27001 it is supplier and change control, applied to a new surface most inventories do not yet list.
CIO / CISO
Add agent configuration to the asset and change record: plugin installs, hook trust records, and MCP server entries for tools such as Codex and Claude Code, on developer machines first. Set the policy plainly, that installing into another product's configuration and self-approving trust is not acceptable vendor behavior, and put it in procurement and renewal conversations. For Postman specifically, decide whether existing users keep, remove or re-approve the integrations, and record the decision rather than letting each laptop decide silently.
Engineers
Check your own machines before theorizing: look for a Postman entry in the Codex configuration and its hooks state, a postman plugin in the Claude Code settings and installed plugins file, any session-start hook mentioning Postman, and MCP entries pointing at Postman's servers. Removing the desktop app may not remove the agent integrations, so verify each location after uninstall. If your team standardizes agent setups, pin the configuration in version control so silent changes show up as a diff.
Everyone (non-IT)
If you use Postman alongside an AI coding tool, nothing here means your data was stolen; the connection that could have carried data failed to authenticate in the documented case. It does mean an update may have added plugins you never chose. A quick look at the plugin list in your coding agent is worth five minutes, and removing anything you do not recognize is a reasonable step.