Postman Faces Criticism over Auto-Installing AI Plugins and Auto-Approving Codex Hooks
AI assistants · AI coding
Postman desktop users reported that the tool automatically installed Codex and Claude Code plugins without explicit consent, with an installer attempting to auto-approve startup Hooks. Postman explained the bundling aimed to ease setup friction and pledged to review consent and Hook workflows, though no patch timeline was shared.
Users of API development tool Postman reported that its desktop client automatically installed plugins for Codex and Claude Code without explicit consent. Certain installer versions also attempted to approve session startup Hooks on behalf of users by injecting trust records into Codex configuration files, sparking authorization concerns. According to GitHub issue reports and logs, Postman 12.33.4 automatically installed plugins alongside CLI tools and bypassed manual approvals by writing trust hashes directly to Codex. While version 12.35.1 was also found to install plugins automatically, logs showed no auto-approval records. Postman responded that bundling AI agent plugins and CLI tools was intended to reduce setup friction, noting components can be uninstalled from the app. The company pledged to improve user consent mechanisms and review Hook approval workflows, though no release schedule was provided.
Key takeaways
- Desktop Postman updates automatically installed Codex and Claude Code plugins alongside CLI tools without explicit consent.
- The installer code attempted to bypass manual approval by auto-registering trust records for Codex startup Hooks.
- Postman explained the bundling aimed to ease setup and promised to review consent and Hook behaviors, with no fix date given.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.