Postman is having a rough week. A GitHub issue says its desktop app quietly installed its own plugins into AI coding agents on users’ machines, specifically Claude Code and Codex. On Hacker News the story passed 1,100 points and 360 comments in well under a day.
The HN headline and the original report don’t say quite the same thing, though, and that gap is the most useful thing to understand here.
What the issue actually reports
It started with an issue filed October 25 on Postman’s official support repo, tagged “[SEVERE]” right in the title. The reporter was on Postman desktop 12.33.4 for macOS. After reopening the app following a stretch of not using it, they found several changes.
Postman’s log showed an auto-existing-upgrade source installing Postman plugins for both Claude Code and Codex. The Codex config (~/.codex/config.toml) had a new Postman marketplace entry, an enabled Postman plugin, and hook-state entries marking hooks as trusted. A Postman CLI had also landed in ~/.local/bin.
The part the reporter cared about most was a SessionStart hook. Every time the agent starts, it injects an instruction to load Postman’s API skill for non-trivial API work, whether or not you asked for Postman. The reporter points to a function in the installer source that approves the hook itself. They’re careful to add that the source alone doesn’t prove who wrote a specific trust record.
And one sentence matters a lot: the reporter says plainly that they have not shown any data exfiltration. The issue is about installing things without consent and changing what your agent is told to do.
Why the headline got bigger
The HN title says Postman “attempts to share all API data.” That part isn’t in the original issue. A remote Postman MCP server (mcp.postman.com) was registered in the Codex config, but the connection failed with an authentication error.
People jumped to data anyway, and the comments explain why. Plenty of older grievances surfaced. One commenter said they found Postman sending request logs and filled-in secrets to its servers while reviewing HIPAA compliance. Another said a healthcare security team decertified Postman and their team moved to another tool overnight. These are individual accounts I can’t verify, but they show how much distrust was already there.
How Hacker News reacted
Reading about 70 of the comments, a few clusters stand out.
The biggest was alternatives. Bruno, Insomnia, Yaak, Hoppscotch, IDE HTTP clients and plain curl all came up repeatedly, along with the note that Postman collections import cleanly into Bruno. Close behind was the familiar story of a VC-funded tool growing heavier: forced accounts, cloud sync, and now AI features bolted on.
The enterprise angle showed up too. One team said it’s deprecating Postman immediately and hoping to get license refunds. Another described a financial firm paying a lot every month for licenses only one team uses. A smaller group argued for some nuance, saying it’s reasonable for a company to try to make money from its product.
Surprisingly few comments focused on agent security, which I think is the real story. One comment flagged harness trust, prompt injection and remote MCP endpoints being registered without notice. That was about it.
Why the hook is the scary part
Agents like Claude Code and Codex grow through hooks and plugins, so they keep a per-hook record that the user chose to trust it. If the report is right, the installer wrote that trust record itself, standing in for the user. And the hook it trusted tells the agent, on every start, to use one company’s tool.
With Postman, that’s basically an ad inside your agent’s context. With malware, the same technique could plant something like “send this code to that server.” Agent config files are turning into a new place to attack, and this is a clear example of how.
Postman’s response
On November 3, a user named zecoquit replied on the issue. They said the CLI and agent plugins are bundled to make setup easier, that this is mentioned on the download page and in the update flow, and that components can be removed in the app. They also said “we’ve heard you,” that opt-in for existing users will be made clearer, and that hook approval and session-start behavior are under review. The page doesn’t confirm that this person works at Postman, and no fixed version has been announced.
The same day, another user reported the same behavior on 12.35.1. On November 4, someone noted that the in-app uninstall left a Postman entry behind in Copilot’s ~/.copilot/settings.json.
Where to check your own machine
If you use Postman desktop alongside Claude Code, Codex or Copilot, these are the locations mentioned in the issue and its comments:
~/.codex/config.toml: Postman marketplace, plugin and hook-trust entries- Claude Code settings: an enabled Postman plugin
~/.copilot/settings.json: a Postman entry~/.local/bin: the Postman CLI
Remove anything you didn’t ask for, and check again after using the in-app uninstall. On a work machine, tell your security team first.
Research period and sample
- Researched: November 4, 2026
- GitHub issue #14370: original report plus six notable comments, including the reply that appears to come from Postman’s side
- Hacker News thread: about 1,100 points and 362 comments, of which roughly 70 were read
- Reddit couldn’t be accessed with the tools used for this piece.
- Personal accounts in comments (data being sent, company responses) are the commenters’ claims and weren’t independently verified here.