Postman desktop auto-installs Codex/Claude plugins, tries to trust its own startup hook
jedisct1 · x · 2026-11-04
A SEVERE GitHub issue reports that opening Postman desktop (12.33.4) on Mac silently installed a user-wide Codex plugin, a startup instruction hook, a remote MCP connection, a Claude Code plugin, and the Postman CLI — causing repeated MCP auth warnings and Codex routing API work through Postman skills. Postman's own logs record the automatic installation. The reporter calls it a severe consent and trust-boundary violation: an API client shouldn't make itself the default workflow in other tools just because it was opened.
More from coding & agent
- 20 open-source AI agent eval tools worth knowing in 2026 — MaryamMiradi · 2026-11-04
- Hermes Agent Mobile App Demoed in Video, Still in Private Beta — Teknium · 2026-11-04
- Google Antigravity brings its coding agent to Eclipse IDE, joining VS Code and JetBrains — rseroter · 2026-11-04
- Meta and Duke paper: reward hacking spreads between agents, hitting Claude and Gemini 73% of the time — rohanpaul_ai · 2026-11-04
- Keeping a Codex agent autonomous 24/7 for weeks via self-reminders — StasBekman · 2026-11-04
- Predictable mcp. subdomain plus SEP-2127 discovery for hosted MCP services — RevolutionaryRoad911 · 2026-11-04