TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A GitHub issue documents one macOS user’s Postman installation automatically adding integrations for Codex and Claude Code, along with a broad instruction hook and a remote MCP connection. The report says it does not establish data exfiltration, and the supplied material does not include a Postman response or a clean-machine reproduction.
A macOS user has reported that opening Postman desktop 12.33.4 automatically installed Postman integrations for Codex and Claude Code and changed user-level coding-agent settings, including adding a startup hook that directs broad API work to Postman tools. The GitHub issue documents the user’s investigation and points to installer source code, but it does not establish that API data was sent to Postman or anyone else; the supplied report also does not include a response from Postman.
The report says Postman’s local application log recorded an automatic installation on October 24, 2026. The logged result names Codex and Claude Code as installed and describes the operation as an “auto-existing-upgrade.” The reporter says the affected machine was signed in to Postman and was running macOS. They also found Postman’s CLI in the user’s local bin directory, with modification times matching the installation period.
In Codex’s global configuration, the user found a Postman marketplace entry and an enabled Postman plugin. The installed hook runs at session startup and prints an instruction to load Postman’s API-engineer skill before answering a broad range of non-trivial API engineering requests. The reporter says this explains why Codex repeatedly announced that it would route API work through Postman. The hook’s scope, as described in the referenced file, goes beyond a request specifically asking to use Postman.
The issue also cites installer code that calls a function to approve Postman’s hook after installation. The report distinguishes that source-code evidence from proof of a particular user action: it says a trust record was present but does not claim that the record alone establishes who created it. A Postman remote MCP endpoint was also configured for Codex, but the reporter’s logs show authentication failures rather than a working connection. The report describes the Claude Code plugin and CLI as additional changes found on the same machine.
Consent Across Coding Tools
The issue concerns a boundary between an application a person opens and other tools that can read or act on their behalf. Installing a plugin, adding a remote service, or changing startup instructions can affect later coding-agent sessions, including tasks the user did not intend to handle through Postman. That makes clear, tool-specific consent central to the concern raised by the report.
For developers, API work can involve sensitive material such as endpoint definitions, test data, credentials, and internal service details. A configured integration may create a route through which information could be processed, but configuration is not proof that information was transmitted. The issue provides evidence of installation and instruction changes, not evidence that API data was exfiltrated or that unauthorized access occurred.
The reported authentication failures are also relevant: they indicate that the configured MCP connection did not successfully initialize in the logs cited by the user. They do not show what would happen after authentication or whether data would be shared in a functioning session. Establishing those points would require further technical evidence and a response from the company.
Products Worth Considering
Apple MacBook Air 15-inch with M5 chip, 24GB RAM, 512GB SSD, Midnight
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
EcoFlow Delta 3 Portable Power Station – 1024 Wh, 1800 W
As an affiliate, we earn on qualifying purchases.
What the Local Evidence Shows
The report is a user-submitted issue in Postman’s public GitHub support tracker, not an independent security audit or a confirmed company incident statement. It includes excerpts from the reporter’s local logs and configuration, alongside links to Postman’s public plugin repository at a specified source revision. The user says private paths, account identifiers, credentials, and unrelated logs were excluded.
The reported versions are Postman desktop 12.33.4, Codex plugin 1.1.0, and Claude Code plugin 2.0.1. The issue says the installation sequence was observed after opening an existing Postman installation that had not been used for a while. However, the reporter explicitly states that the sequence had not yet been reproduced on a clean Mac. That limits what can be concluded about how often the behavior occurs or which configurations trigger it.
The title’s suggestion that Postman attempts to share “all API data” is not supported as an established outcome by the evidence described. The issue documents an integration and broad routing instructions, while expressly disclaiming a finding of data exfiltration. The distinction matters: an enabled connector or instruction can raise a consent concern without proving that all collections, requests, or other API data were transmitted.
“auto-existing-upgrade”
— Postman’s desktop log, as quoted in the GitHub issue
Frequency and Data Flow Unverified
The available material does not establish whether the behavior affects other users, which Postman versions or account settings trigger it, or whether the sequence can be reproduced on a clean macOS installation. It also does not include Postman’s explanation of the upgrade process, its intended consent flow, or whether the installation behavior was expected.
No evidence in the report shows API data being sent through the MCP connection or otherwise exfiltrated. The cited Codex logs instead show an authentication failure. It remains unclear what data a functioning, authenticated integration can access, what safeguards or user prompts apply, and whether any information was processed during a session not covered by the cited logs. The reporter’s local files and linked source are not a substitute for a broader independent assessment.
Company Response and Reproduction
The GitHub issue asks Postman to stop automatic installation of agent plugins and the CLI for existing desktop users until they give explicit opt-in, and to remove installer-side approval of its own hook. Those are requests from the reporter, not changes confirmed in the supplied material.
The next evidence needed would include Postman’s response, a reproducible test on a clean machine, and a clear account of what the plugins and remote MCP can access and when they transmit information. Users reviewing their own setups can inspect relevant agent integrations and configuration, but the issue alone does not establish that every Postman user has been affected or that API data has been shared.
Key Questions
Did Postman send users’ API data to an external service?
The GitHub report does not establish that API data was transmitted. It documents installed integrations, configuration changes, and a remote MCP connection that reportedly failed authentication in the cited logs.
What did the user say Postman installed?
The user reports that Postman installed its Codex and Claude Code plugins, added a Codex startup hook, configured a Postman MCP connection, and placed a Postman CLI executable on the machine.
Did the report prove the hook was approved without the user’s consent?
It cites installer code that attempts to approve Postman’s hook after installation. The reporter says the trust record alone does not prove who created it or establish a particular user interaction.
Has Postman confirmed the behavior or responded to the issue?
No Postman response is included in the supplied source material. The report also says the observed sequence had not been reproduced on a clean Mac.
What is the user asking Postman to do?
The reporter asks Postman to pause automatic agent-plugin and CLI installation for existing desktop users until they explicitly opt in, and to remove installer-side self-approval of its hook. These are requests, not confirmed company actions.
Source: github.com
