Concerns Raised Over Postman's Silent Plugin Installation
Postman Desktop's recent update has stirred security concerns due to its automatic plugin installation feature.
On October 24, a recent update to Postman Desktop quietly installed plugins into Codex and Claude Code. This action prompted significant attention when a developer, known as indicava, reported the issue on GitHub the following day, citing specific log entries that revealed how the installation and startup processes worked.
Details of the Installation
According to the GitHub issue (#14370) filed on October 25, the installer executed `auto-existing-upgrade`, leading to the installation of Codex version 1.1.0 and Claude version 2.0.1 on Postman Desktop version 12.33.4. The installation process affected several files on macOS, including `~/.codex/config.toml`, `~/.claude/settings.json`, and `~/.claude/plugins/installed_plugins.json`. Additionally, a Postman executable was placed in `~/.local/bin`. The configuration pointed toward an MCP server at https://mcp.postman.com/mcp, but logs indicated an authentication failure during the session initialization.
Security Implications
The crux of the issue lies in the startup instruction embedded within the installation process. This instruction directs the coding agent to load the `postman:api-engineer` skill before responding to API-related tasks. Such routing means that any API requests will go through Postman's skill, not just those explicitly labeled by the user.
What raises eyebrows is a particular function named `approvePostmanHook`, which automatically records the hook's `trusted_hash` into the application's trust store as soon as it installs. While Codex has a hook-approval mechanism intended to prevent unauthorized code execution, this design flaw allows the installer itself to approve its own hooks.
Community Reactions and Next Steps
A follow-up article by Frank Chu on dev.to, published on November 3, echoed these concerns, highlighting the behavior of the installation process. Notably, this behavior has yet to be demonstrated on a clean system by third-party testers. As it stands, Postman has not issued any public statements regarding the matter.
The GitHub thread discussing the incident, which has amassed 99 thumbs-up reactions, is urging Postman to halt the automatic plugin installations until users can explicitly opt-in. The community is also calling for the removal of the installer’s ability to approve its own hooks and for a refinement of startup instructions to require explicit user requests.
This situation feeds into a broader discussion about trust and security in coding agents. In a related note, our tracker recorded that OpenAI has seemingly re-enabled the training-on-chats toggle for certain users of Codex this week, further fueling discussions about security practices in AI tools.