Postman 12.33 Wrote a Self-Approved Hook Into a User's Codex Config, According to a GitHub Issue

A Postman desktop user reported on Oct. 25 that version 12.33.4 on macOS added Postman plugins to both Codex and Claude Code without asking, and wrote a trust record into Codex's global config approving Postman's own startup hook. The report, issue 14370 in the postmanlabs/postman-app-support repository, had drawn five user comments by Nov. 3 and no reply from anyone at Postman.

The filer, who goes by indicava, titled it "[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook." The issue has no labels, assignee or milestone. Nothing here has been confirmed by Postman, and the account rests on one user's logs.

What the report says changed on one machine

The reporter lists six changes, grouped below, and attributes them in a log line to an auto-existing-upgrade source that ran for an existing user at launch.

Where	What the issue says appeared
Codex global config	Postman plugin 1.1.0 and a marketplace entry
Codex global config	A SessionStart hook and a trust record approving it
Codex global config	A remote MCP entry for Postman's server, which failed authentication
Claude Code, user scope	Postman plugin 2.0.1
~/.local/bin	A Postman CLI executable and library

The filer says the Codex plugin came from source revision 6c8e452e. The issue does not claim any data left the machine: it states that it "does not claim to establish data exfiltration."

The hook is a standing instruction to the agent

The part that goes beyond a stray install is the hook text. The plugin repository at that revision holds a file that opens with the tag <EXTREMELY_IMPORTANT> and tells the agent: "Before responding to any non-trivial API engineering task", load the postman:api-engineer skill and follow it. It lists 11 more skills the agent may enter directly.

The file does include a limit. Subagents are told to ignore it, and it says "User instructions (project instruction files such as AGENTS.md or CLAUDE.md, and direct requests) take precedence over this mandate." So a developer's own rules still win. The default, though, is that an API client has put itself first in line in a different company's coding tool.

The installer source comment, as quoted in the issue, reads "Approves only Postman's current hook after installation." That is the self-approval the title refers to. The documentation quoted below confirms the installer does this for Codex.

What Postman's documentation says about installs

Postman's plugin install page describes a manual route: run npx @postman/postman-plugin, which installs into every detected agent, with --agent to narrow it. A confirmation is required outside a terminal unless --yes is passed, and remove uninstalls. The detected-agents page says that for Codex the installer "approves the hook for you."

Neither page mentions the desktop app, and neither says an existing install will be upgraded into this. That gap is what the issue turns on. The documented command is a choice. The reported behavior, if it happened as described, was not.

The docs also say Postman's "skills and MCP server work either way, with or without the hook," which makes the hook's approval step the optional part.

What the reporter asked for

The filer wants four things: opt-in installation, removal of the self-approval, a rollback path, and narrower skill instructions. They wrote: "An API client should not make itself the default workflow in other tools simply because I opened it."

The comments are mostly anger, and one asks for a hook-removal button, with a screenshot of what the commenter says is such a control. That commenter says they have not tried it. No one else in the thread reports the same install.

This follows Claude-Mem's installer uploading 30 days of prompts before asking, another installer that acted before it asked. A single report on 12.33.4 is also not a measure of how many installs were touched. The next thing to watch is Postman's reply on issue 14370 and whether Postman's release notes for 12.33 ever mention it; the release-notes page did not list that version when fetched on Nov. 3. A related case: Agent-Desktop 1.0 ships a macOS bug that types into the frontmost app.