AI Briefing
KOSign in

Postman Desktop Auto-Installs Claude Code and Codex Plugins Without Explicit Consent

·2026.10.26 04:07

Key point

Postman desktop version 12.33.4 automatically installed and enabled Claude Code plugin 2.0.1 and a Codex plugin at user scope during an upgrade.

Details

  • Postman desktop 12.33.4 auto-installed and enabled the Postman plugin for Claude Code (version 2.0.1) and Codex (version 1.1.0) at user scope without explicit user consent.
  • Log entries from 2026-10-24T09:34:14.418Z confirm the auto-installer executed the installation, with results recorded as "claude-code:installed" and "codex:installed".
  • The installer modified ~/.claude/settings.json and ~/.claude/plugins/installed_plugins.json, and wrote hook trust hashes to the Codex global config to approve startup hooks.
  • Users are advised to inspect local configuration files and use the provided uninstall command to remove the unwanted user-scope plugins, as deleting the Postman app alone leaves agent integrations behind.
securityclaude-codecodexpostmanconsentplugin-installation
Read originalShare on Threads

This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.

Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.

Related

AWS Tech Blog (Korea)Uber Achieves 52% Reduction in Per-Session AI Agent Costs Through Cost Structure Analysis and OptimizationGeekNewsT3 Code releases open-source control surface for managing multiple AI coding agentsVercel BlogAI Gateway adds Sessions view to logs for tracking session affinity and cache efficiencyHacker NewsNeckbeard – a DevOps/platform/SRE plugin for your agentHacker NewsNvidia OpenShell: Secure Runtime for Autonomous AI Agent FleetsTLDR AIClaude Mods: Flipping the Agent Harness to Face the Human