Postman desktop app reported to auto-install Claude Code/Codex plugins; opt-in to be clarified

shoumikgoswami · reddit · 2026-11-04

GitHub issue #14370 reports that opening Postman's desktop app installed plugins into Claude Code and Codex without a prompt, citing the app's logs.

Postman's head of product told RuntimeWire the company will make the opt-in clearer, especially for existing users, and is reviewing hook approval and session-start behavior.
A second user reproduced plugin installation on a newer build but found no hook trust entry in their Codex config, so that part of the original report wasn't reproduced.
Why it matters: changes to an agent's plugins and startup hooks can alter the instructions it receives — an agent supply-chain security concern.
Caveat: these are reports from individual machines, not evidence every installation behaves this way or that data was stolen.

The post also opens a debate: should another app be allowed to install a coding-agent plugin without confirmation inside the agent itself?

More from coding & agent