Postman Installed Claude Code and Codex Plugins Without Explicit Consent
Postman logs and installer code show that its desktop app automatically installed user-scope Claude Code and Codex plugins, while one installer path attempted to write trust state for a Codex startup hook. Another user reported the same automatic installation in Postman 12.35.1, although that configuration did not contain hook-approval records. Postman said the bundled setup was intentional to reduce setup work and that it would review the opt-in and hook-approval mechanisms, but no corrected release or timetable had been announced.
The reported behavior lets a separate desktop application modify coding-agent configuration and, in one installation path, approve a startup hook without an explicit user choice.
A heads-up for Claude Code users who also have Postman installed: after I opened Postman on my Mac for the first time in a while, a local audit found that its desktop auto-installer had installed and enabled a Claude Code plugin at user scope. The same run installed a Codex plugin too.
I asked Codex to inspect the logs, configuration and cached installer source. I consider an API client changing unrelated coding-agent setups a serious consent and trust problem. I have removed the app and integrations.
Direct Claude Code evidence
Postman's main.log at 2026-10-24T09:34:14.418Z records:
text PostmanAgentPluginService~install: script completed {"source":"auto-existing-upgrade","results":["claude-code:installed","codex:installed"],"installer":"script"}
The next entry says autoInstall.plugin.existing-user finished with outcome installed, signedIn true, useScript true, and scriptResults claude-code:installed,codex:installed.