Postman Auto-Installed Claude Code and Codex Plugins
Check and Remove
Postman desktop reportedly auto-installed Claude Code and Codex plugins and a CLI for existing users. No exfiltration is shown. How to check and remove them.
A GitHub issue (#14370) reports that the Postman desktop app installed Postman plugins for coding agents such as Claude Code and Codex, plus the Postman CLI, into existing users' environments without any action by the user. The log source reads auto-existing-upgrade, and several users report similar traces. The reporter says the issue does not establish that data was exfiltrated. First check whether entries remain on your machine with the commands below.
The issue was opened on October 25, 2026 and drew attention on Hacker News on November 3 and 4. This article treats the issue text and its comments as the primary source and separates what was reported and corroborated from what is still unconfirmed, as of November 4, 2026. We could not confirm an official fix release or an official removal procedure from Postman at that time. The goal is not to criticize a product but to lay out, from an engineer's point of view, the structural problem of agent settings being changed without consent.
What happened
The reporter (indicava) found, on macOS with Postman desktop 12.33.4, that the Postman plugin for Codex (1.1.0) and the Claude Code plugin (2.0.1) were present although they had not installed them. Postman's log (~/Library/Application Support/Postman/logs/main.log) reportedly contained, at 09:34 UTC on October 24, 2026:
- "source":"auto-existing-upgrade" (a name that reads as an automatic install during an existing user's upgrade)
- "results":["claude-code:installed","codex:installed"]
- "installer":"script" and "signedIn":true
Another user (ronthedrummer) reports that on November 3, after Postman desktop updated from 12.31.3 to 12.35.1, the same auto-existing-upgrade log appeared, with Claude Code and Codex recorded as installed and Cursor as already installed. A Postman CLI (version 1.85.0) also appeared at ~/.local/bin/postman. Similar logs from two environments add credibility, but both are individual reports, not an official explanation from Postman.
Confirmed facts versus unconfirmed claims
Strong phrasings such as "tries to share all your API data" have circulated, so here is what the issue says, grouped by how well it is supported.
| Claim | Status |
|---|---|
| Plugins were installed automatically for existing users on update | Two reporters posted log excerpts (12.33.4 and 12.35.1); the reports are consistent |
| The plugin was enabled in Claude Code settings | Reported: postman@claude-plugins-official enabled in ~/.claude/settings.json, version 2.0.1 recorded in installed_plugins.json |
| A marketplace and plugin were added to Codex config | Reported: [marketplaces.postman] and [plugins."postman@postman"] (enabled = true) added to ~/.codex/config.toml |
| Instruction injection at session start | The reporter describes from the source that a plugin hook prints text telling the agent to load Postman skills before non-trivial API engineering tasks. One other user saw the same text in Cursor sessions; that is a single observation, and actual behavior in Codex is unconfirmed (the reporter corrected this on November 4) |
| The installer self-approved its own hook | The reporter says the source contains such an approval attempt, but also says the trust record alone does not prove who created it. In ronthedrummer's environment there was no trusted_hash entry |
| A remote MCP server was added | Logs reportedly show mcp.codex.json pointing to https://mcp.postman.com/mcp, with startup failing because authentication was required |
| Copilot CLI was also configured | ck-tecso reports "postman@postman": true in ~/.copilot/settings.json (one report) |
| Data exfiltration | Not confirmed. The reporter explicitly says the report does not establish it, and another reporter says there is no evidence of upload |
| Postman's response | On the issue page only a quote relayed in a comment (to make opt-in clearer for existing users). No official fix or statement was confirmed as of November 4 |
In short, what is best supported is that plugins and a CLI were installed into existing users' environments without a consent screen, and that enabling entries were written into agent settings. Claims about intent, such as deliberately collecting secrets or circumventing review via hooks, are not established. The sensible response is to check and clean up your settings calmly.
Why this is being treated as a problem
The issue is not whether data was stolen; it is the consent boundary. Coding agents run close to your repositories and credentials. A state in which another app can add plugins to an agent's config and inject startup instructions carries these risks.
- A larger instruction-injection surface: third-party text enters the agent's context at every session start. Even if benign today, it can change later (the source is a git repository that follows marketplace updates)
- An external MCP server gets registered: once authenticated, it becomes a route for the agent to talk to an external service. Even unauthenticated, its presence in config is something to audit
- Automatic trust: agents have a mechanism to review and approve hooks. The report says the installer attempted that approval on the user's behalf; claims are split on this point and it needs verification
For a related case where a developer tool's distribution channel was abused, see our summary of the Claude Code extension backdoor on the Cursor marketplace. The nature differs, because no malicious intent has been established here, but the pattern is shared: something the developer did not knowingly install lands on the developer's machine.
Conditions that appear to apply
Based on what the reports show; this is not a confirmed specification.
- You use the Postman desktop app (the reports are on macOS; behavior on Windows and Linux could not be confirmed from these sources)
- You are signed in, and the log shows "signedIn":true and "exposed":true
- An existing installation was updated (the reports involve 12.33.4, and an update from 12.31.3 to 12.35.1). Whether a fresh install behaves the same is unknown; the reporter did not reproduce it on a clean Mac
- The same machine has agents such as Claude Code, Codex, Cursor or Copilot CLI. Reported targets are Claude Code, Codex, Cursor (recorded as already installed) and Copilot CLI (another report)
- If you use only the browser version of Postman, the desktop update path does not run, so you are likely outside the reported behavior (partly inference)
How to check your environment
These examples are for a macOS or Linux shell, with paths taken from the reports. They only read; they change nothing.
First, check whether Postman's log records an automatic install (macOS path).
grep -n "auto-existing-upgrade" "$HOME/Library/Application Support/Postman/logs/main.log" | headNext, look for Postman entries in each agent's config.
grep -n -i postman ~/.claude/settings.json ~/.claude/plugins/installed_plugins.json ~/.codex/config.toml ~/.copilot/settings.json 2>/dev/null
ls -la ~/.local/bin/postman 2>/dev/null
ls -d ~/.claude/plugins/cache/*postman* 2>/dev/nullNo hits means no traces in the reported locations. If there are hits, check how it is enabled (enabled = true, "postman@..." : true and so on). For Cursor, check whether Postman appears in the plugin and MCP management screens. Because it may be installed in places not mentioned in the reports, open each tool's plugin list as well if you use several agents.
How to remove or disable it
Note: these are general steps for disabling or deleting the relevant entries in each tool's settings, not an official Postman procedure. We could not confirm an official removal procedure as of November 4. Back up the config files first.
There are reports of a menu item, Help, Postman CLI and Plugins, Uninstall Postman Coding Agent Plugin. However, ck-tecso reports that Copilot settings remained after running it (one report). Even if you use the menu, rerun the check commands afterwards.
Claude Code
You can disable or uninstall the Postman plugin with Claude Code's plugin management command (/plugin). If that is not possible, set the key to false, or delete the line, under enabledPlugins in the user settings file ~/.claude/settings.json.
"enabledPlugins": {
"postman@claude-plugins-official": false
}Cached files are under ~/.claude/plugins/. Check that they are not mixed with records of other plugins before deleting. For how the official marketplace works, see our guide to the claude-plugins-official directory.
Codex
Disable or delete these parts of ~/.codex/config.toml. Leaving the marketplace definition in place may allow reinstallation later.
[marketplaces.postman] # delete
[plugins."postman@postman"] # set enabled = false or delete
[hooks.state."postman@postman:..."] # delete the trust record if presentCursor, Copilot CLI and others
In Cursor, disable or remove Postman from the plugin and MCP server lists. For Copilot CLI, remove the Postman entries from extraKnownMarketplaces and enabledPlugins in ~/.copilot/settings.json, or set them to false. These locations come from the reports and may differ by version.
Postman CLI
A report says a CLI was placed at ~/.local/bin/postman with a sibling lib directory. If you do not use the Postman CLI you can delete it, but check postman --version and the modification time first to tell it apart from anything you installed yourself. Whether a later update reinstalls it while the app remains is unconfirmed. After updating, run the check commands again.
What organizations should do
Checking one person's settings leaves gaps as the number of machines grows. Consider the following.
- Inventory machines: find developer and QA machines with the Postman desktop app, distribute the check commands above and collect results
- Monitor config files: add ~/.claude/settings.json, ~/.codex/config.toml and ~/.copilot/settings.json to MDM or EDR file monitoring. Check the latest documentation of your tools for managed policies that restrict plugin sources
- Update operations: roll out developer-machine app updates only after reviewing the changes, and pause auto-update on critical machines
- Approval flow for agent tooling: if you gate plugin and MCP additions, include cases where an app adds them on its own
- Network review: look in proxy or DNS logs for mcp.postman.com (appearing there is not evidence of exfiltration by itself)
Companies with little IT staff often cannot inventory every developer tool. Start by listing the desktop apps developers use that can touch agent settings, and prioritize using the approach in our IT risk guide.
Comparing alternative tools
Whether to keep using Postman depends on your policy and use case. If you are considering a move, here is what we could confirm on each official site. Prices and features change, so check the latest information before adopting.
| Tool | Features confirmed on the official site | Notes |
|---|---|---|
| Bruno | Described as free and open source. Collections are folders and text files on your filesystem, manageable with Git. States there is no cloud sync, account or login, and that data never leaves your machine. Runs on macOS, Windows and Linux. Also lists enterprise features such as SSO/SAML | The home page names no specific license and gives no prices; check the official docs |
| Insomnia | Provided by Kong Inc. Has an open-source and free tier. Storage can be local, Git or cloud (cloud with optional end-to-end encryption). Has the Inso CLI for CI | The home page names no license or prices; check the GitHub repository and pricing page. Choosing cloud storage places data externally |
| Hoppscotch | Described as an open source API development ecosystem | We could confirm only the summary; check the docs for self-hosting, license and pricing |
We hold back on Milkman and other tools because we could not verify official information this time. As evaluation criteria: (1) where data is stored (local, Git or cloud), (2) whether an account is required, (3) whether updates touch agent settings, (4) license and operator, and (5) how teams share collections. Whichever you choose, keeping file-based collections in Git makes switching tools easier.
FAQ
Was my data sent externally?
No evidence that data was sent has been confirmed so far. The reporter says the report does not establish exfiltration, and another reporter says there is no evidence of upload. The phrasing that Postman "tries to share all your API data" is an interpretation, not a confirmed fact. Still, a registered MCP server and hook-injected instructions could become pathways under the right conditions, so check your settings.
Is everyone who uses Postman affected?
No. The reports come from existing desktop installations that were upgraded. Browser-only use, or machines without agents, appear to be outside the reported behavior. How a fresh install behaves has not been confirmed, so the check commands are the reliable way to see your actual state.
Is uninstalling from the Postman menu enough?
There is a report of a menu item for this, but ck-tecso says Copilot settings remained. After running it, check each agent's config files for leftover Postman entries.
Was the Codex hook auto-approved?
The reporter says the source contains approval logic, but also says it cannot prove who created the trust record. In another reporter's environment there was no trust record. It is unresolved, so check your own config.toml rather than assuming.
Has Postman responded?
On the issue, only a quote relayed in a comment is visible (about making opt-in clearer for existing users), and we could not verify its source. As of November 4 we could not confirm an official fix release or removal procedure. Check the issue and Postman's official announcements for updates.
Sources
- GitHub: postmanlabs/postman-app-support issue #14370 (opened October 25, 2026)
- Bruno official site
- Insomnia official site
- Hoppscotch official site
Related free tools (no sign-up, instant results)
Feel free to contact us
Contact Us