Postman Installed Itself Into Your Coding Agents

On October 25, 2026, a Postman user reported that simply opening Postman desktop auto-installed plugins into Codex and Claude Code and tried to trust its startup hook, without asking. The report documents a consent failure, not a proven data theft: the remote connection it created never authenticated, so no data flowed through it in this case. That distinction is the whole story, because the violation is real even though the worst fear is not proven.

What the logs show

The report, filed as issue 14370 in Postman's public support tracker on October 25, 2026, is a forensic account from one Mac, not a press release. The user opened Postman desktop version 12.33.4 and then found recurring authentication warnings and Codex routing API work through Postman's skills. Investigation of Postman's own log showed an entry timestamped October 24, 2026, at 09:34 UTC, recording an automatic installation with the source label "auto-existing-upgrade" and the results "claude-code:installed" and "codex:installed". The changes found on the machine were:

Each of these is the kind of change that should require a clear, specific opt-in in the affected application. Installing a plugin, adding a remote connection, and trusting a hook in another program are three separate permissions, and the report shows all three happening as a side effect of opening a different application. The reporter states the principle plainly: an API client should not make itself the default workflow of other tools simply because the user opened it.

What it does not prove

Some coverage of this report has gone further than the evidence, describing it as an attempt to share all API data. The report itself does not support that version. The reporter explicitly states that private paths, unrelated logs, account identifiers, and credentials are excluded from the report, and that the report establishes unwanted integration and instruction changes, not data exfiltration. The remote MCP connection, the only channel that could have carried data to Postman's server, failed at startup because authentication was required, so in this instance it carried nothing.

Two limits apply to everything above. First, this is a single-user account, detailed and log-backed but not yet independently reproduced in the material reviewed, so it proves what happened on one machine, not what happens on every machine. Second, Postman's intent is unknown: an automatic upgrade path for existing users could be a bug, a mis-scoped rollout, or a deliberate growth tactic, and the logs alone cannot distinguish those. What the logs do settle is the mechanism. The installation was automatic, it crossed into two unrelated tools, and it happened without a prompt the user can point to.

Why this is a trust-boundary problem, not just a bug

Coding agents run with a developer's credentials, source code access, cloud tokens, and often production deployment permissions. A plugin inside such an agent is not a theme or a toolbar button. It is code that runs where the developer's secrets live, and a trusted hook can change what the agent does before the developer sees it. That is why installation path has become a security frontier in its own right: a September 2026 disclosure, widely discussed as Plugin4Shell, showed that the install mechanism shared by major coding agents could run code without further interaction, and the fix was to treat installed plugins as software supply chain, with allowlists and provenance checks.

Postman's case lands awkwardly against its own recent work. On September 15, 2026, Postman announced general availability of Passport, a product that keeps real API credentials inside the customer's environment while developers and agents receive governed, task-scoped access. The idea behind Passport is that agents should act without holding the keys. The desktop behavior reported here points the other way: an agent's configuration changed without the developer's governed approval, which is exactly the failure Passport exists to prevent. Readers do not need to resolve whether this was a bug or a strategy to see the contradiction. A vendor cannot sell governed agent access with one hand and auto-install into agents with the other and expect developers to trust either gesture.

For developers, the practical response is an audit, not a boycott. Check the plugin sections of your coding agent configurations for entries you did not add, check the installed-plugins record for timestamps that match application launches rather than your own actions, check your local binary folder for executables you did not place there, and disable automatic plugin installation where your agent supports it, requiring an explicit, logged action instead. That routine is also the durable lesson of this story, and it connects directly to the question ByteHerald examined in our comparison of the emerging agent identity stack: who verifies the agent, what credential it carries, and who is liable when it acts. A plugin installed without asking is an identity the developer never issued. And it belongs beside our map of who blocks AI agents, and what it costs, because blocking and silent installation are the two sides of the same unresolved question: who gets to decide what runs inside an agent.

By ByteHerald Staff. Postman support tracker issue 14370, October 25, 2026, reported by a user that opening Postman desktop version 12.33.4 on a Mac was followed by automatic installation of Codex plugin version 1.1.0 and Claude Code plugin version 2.0.1, a startup instruction hook trust attempt, a remote MCP connection that failed authentication, and a Postman CLI executable, with Postman's own log recording source auto-existing-upgrade on October 24, 2026, and the reporter explicitly stating the report does not claim to establish data exfiltration. Hacker News, November 3, 2026, carried the report to its front page. Postman, September 15, 2026, announced general availability of Passport, keeping real API credentials inside the customer's environment while developers and agents receive governed access.