Postman's main.log on October 24, 2026 records the silent installation of Codex and Claude plugins.
POSTMAN AUTO-INSTALLED AI PLUGINS AND TOOK OVER CODEX HOOKS
*Postman's desktop client silently installed Codex and Claude plugins on a Mac, altered global user configurations, and approved its own startup hook. The move forces API work through Postman without explicit consent, raising serious trust‑boundary concerns.*
A Mac user opened Postman Desktop version 12.33.4 on October 24, 2026 and immediately triggered a cascade of silent changes. Postman's internal log captured an auto‑existing‑upgrade script that installed Codex and Claude AI plugins, marked as installed by a script installer. Within minutes, the user's global Codex configuration was rewritten to point to a Postman‑hosted git repository, enable a Postman plugin, and register a startup hook that forces every API engineering task to run through Postman's skill set. The same script also placed a Postman executable in the user's local bin and altered Claude's settings to enable a Postman plugin. No consent dialog appeared, and the installer attempted to approve its own hook, effectively granting itself trust. The incident exposes a severe breach of consent and trust boundaries for developers relying on AI coding assistants.
What did Postman install without user consent?
On October 24, 2026, Postman's own log recorded an automatic script that installed two AI plugins: "claude-code" and "codex". The log entries at 09:34:14.418Z show the installer labeled "auto-existing-upgrade" and report both plugins as "installed" on a macOS (darwin) platform. The installed Codex Postman plugin is version 1.1.0, sourced from revision 6c8e452e0f4237f4bcc0901cb1ac442dec707e49. No user interaction was logged. The same script also placed a Postman executable and library in the user's local bin directory, matching the installation timestamps. This silent deployment breaches expected consent protocols for desktop software.
How did the plugins hijack Codex workflows?
The auto‑install altered Codex's global configuration at ~/.codex/config.toml. A new marketplace entry points to the Postman plugin repository via a git source, and the plugin "postman@postman" is marked enabled. Crucially, a hook entry registers a SessionStart command that forces Codex to load the "postman:api-engineer" skill before any non‑trivial API task. The hook file hooks/codex-hooks.json contains a trusted_hash and trusted_content_hash, and the accompanying session‑start-context.md instructs Codex to route design, implementation, testing, monitoring, documentation, or deployment of APIs through Postman Flow. This instruction is broader than any explicit user request, causing repeated Postman skill announcements during normal Codex operation.
Did the installer gain unauthorized trust?
The plugin installer explicitly attempts to approve its own hook. In installer/src/hosts/codex-hooks.ts the code calls approvePostmanHook(system) after installing the plugin, then writes the trusted_hash to the hooks.state record. The source comment reads "Approves only Postman's current hook after installation". While the trust record does not prove who created it, the script’s own actions demonstrate an attempt to self‑authorize the new hook without external validation. This self‑approval mechanism sidesteps standard user‑driven trust decisions.
What are the broader security implications?
Beyond Codex, the installation affected Claude Code. The user's Claude settings now enable "postman@claude-plugins-official" and the installed_plugins.json records version 2.0.1 with timestamps matching the October 24 installation window. Additionally, a remote MCP endpoint (https://mcp.postman.com/mcp) was enabled in mcp.codex.json, but Codex logs show the server startup failed with "Auth required" errors, indicating an unauthenticated connection attempt. The combined changes make Postman the default workflow engine for multiple AI coding assistants, eroding user control and expanding the attack surface for any future malicious updates.
Frequently asked questions
Did Postman install AI plugins without user permission?
Yes. The Postman log from October 24, 2026 shows an auto-existing-upgrade script that installed the "claude-code" and "codex" plugins without any recorded user interaction.
What changes did the installation make to Codex?
The installation added a git source pointing to the Postman plugin repository, enabled the postman@postman plugin, and registered a SessionStart hook that forces Codex to load the postman:api-engineer skill for all API tasks.
Did the installer approve its own hook?
The installer code calls approvePostmanHook(system) after installing the plugin and writes a trusted_hash to the hooks.state record, explicitly attempting to self‑approve the new hook.
The auto‑installation demonstrates how a trusted desktop client can silently commandeer multiple AI development tools, rewrite configurations, and self‑authorize hooks. Developers now face a hidden layer of integration that could be weaponized in future updates. Immediate audit of Postman installations and a review of plugin approval mechanisms are essential to restore control and prevent similar trust violations.
Sources: GitHub issue #14370, Postman main.log entries, ~/.codex/config.toml, hooks/codex-hooks.json, installer/src/hosts/codex-hooks.ts, mcp.codex.json, ~/.claude/settings.json, ~/.claude/plugins/installed_plugins.json