Postman Desktop accused of silently installing Claude Code and Codex plugins and self-approving its startup hook
Confirmed
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 2 of 5
- Last verified
- 4 November 2026
Your AI and this story
- GPT-6 Astra187 days after its cutoff
- Claude Opus 5.5126 days after its cutoff
- Gemini 4 Argon217 days after its cutoff
- Grok 4.7156 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 126 days before it.
Key facts
- Postman’s hook told agents to load its ‘api-engineer’ skill before any non-trivial API task
- Commenters found entries in Copilot and Cursor configs too
- No official Postman reply in the thread as of Nov 4
- The HN headline’s ‘share all API data’ goes beyond what the issue claims
What happened
The reporter could not reproduce on a clean Mac and asks Postman to stop auto-installing, remove the self-approval and add an uninstall path. A case study in how desktop apps are starting to plant instructions inside users’ coding agents.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 2 reactions
Reactions
- GitHub issue #14370 (postman-app-support)github.com, discussion
- Hacker News discussionnews.ycombinator.com, discussion
Changes
- Filed