Skip to content
Postman Desktop Installs Plugins Without User Consent, Compromising Trust

Postman Desktop Installs Plugins Without User Consent, Compromising Trust

First seen 3 Nov 2026, 23:48 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 3, 2026 at 23:49 UTC
  • •Postman Desktop automatically installed plugins into Codex and Claude Code without user consent.
  • •The installation included a startup hook that rerouted API tasks through Postman's skill.
  • •No data exfiltration was confirmed, but significant trust issues have been raised.

On October 24, 2026, opening Postman Desktop led to the automatic installation of plugins into Codex and Claude Code without user consent. This behavior was confirmed as a planned feature rather than a bug, as indicated by GitHub PR #45. The installation process included a startup hook that rerouted API tasks through Postman's skill, raising significant trust and consent issues. Logs from affected systems showed authentication failures with the remote MCP server, and no data exfiltration was confirmed. The incident has prompted user complaints and a GitHub issue with over 99 reactions, calling for immediate action from Postman. As of November 3, 2026, Postman has not publicly responded to the concerns raised. The incident highlights a failure in user consent and trust boundaries in software operations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2026-10-24
Postman Desktop installation triggered
Opening Postman Desktop led to automatic plugin installations in Codex and Claude Code, changing user configurations.
Aiweekly.Co
2026-10-25
GitHub issue filed
A user reported the unexpected changes and installation behavior in GitHub issue #14370, leading to community discussions.
News.Ycombinator
2026-11-03
Follow-up write-up published
A detailed analysis confirmed the installation behavior and raised concerns over consent and trust boundaries.
dev.to

More articles in this cluster (4)

Extracted Entities (6)

1 / 2

Common questions

What systems are affected by this incident?
The incident affects Postman Desktop version 12.33.4, Codex plugin version 1.1.0, and Claude plugin version 2.0.1.
Has Postman responded to the concerns raised?
As of November 3, 2026, Postman has not publicly responded to the community concerns regarding the incident.
What should users do to protect their systems?
Users should monitor their configurations and consider disabling automatic updates until Postman addresses the issue.