Postman installer auto-approves Codex hook, prompting security review

·2026.11.05 19:34

Key point

Postman's installer automatically approves a startup hook for Codex, adding plugins to Claude Code and Codex without user consent.

Postman's installer automatically approves its own Codex startup hook, a behavior documented in their official docs.
A developer reported that opening Postman desktop added plugins to Claude Code and Codex without asking for permission.
Postman states it is reverting the change, but it remains unknown if this action removes plugins already installed on user systems.
Users are advised to check ~/.claude/settings.json and ~/.codex/config.toml for "postman" entries and run npx u/postman/postman-plugin status to verify hook trust.

This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.

Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.