Postman Auto-Installed AI Agent Plugins and Tried to Trust Its Own Hook
Postman's desktop app auto-installed Codex and Claude plugins and tried to trust its own hook, according to a detailed report; maintainers say they will revert, but the incident fits a broader pattern of enshittification
Postman's desktop app automatically installed Codex and Claude Code plugins for an existing macOS user, according to a detailed issue report, modifying global agent configs and adding a startup hook that routes broad API engineering tasks through Postman skills. The installer also attempted to trust its own hook, and a remote MCP connection failed authentication.
The evidence stops short of alleging data exfiltration, and the requested remedy is to stop automatic installs and remove self-approval. Postman maintainers said they will redesign the opt-in and revert the change.
Key takeaways
- Postman's log recorded an auto-existing-upgrade installing claude-code and codex plugins at 2026-10-24T09:34:14Z; Codex's global config gained a Postman marketplace, an enabled plugin and trusted hook hashes.
- The installed SessionStart hook prints instructions to load postman:api-engineer for any non-trivial API task, and installer source calls approvePostmanHook and upserts trusted_hash via config/batchWrite.
- A remote MCP at mcp.postman.com/mcp was enabled but Codex logs show 'Auth required' on initialize; Claude Code settings enabled postman@claude-plugins-official v2.0.1, and a Postman CLI appeared in ~/.local/bin.
- Requested remedies include severe triage, explicit opt-in, removal of installer-side self-approval, a complete rollback path and narrower startup instructions; the evidence is not claimed to establish data exfiltration.
- Maintainers said they bundled the CLI and plugins because many users had trouble installing and wiring them up separately, and that they are reviewing the hook approval and session-start behavior.
What people think
Analysis details
34 comments analyzed. Analyzed .
The sample selects active discussion branches and includes available parent comments. It may omit parts of the full thread. The analysis included 34 of 49 usable stored comments because of the input limit. Selected themes do not measure community opinion or how common a view is.
VC funding turns tools into bloatware
Postman's forced logins, data collection, subscriptions and AI features are traced to more than $400M raised and 1,500+ employees, with the company needing to justify a $5B+ valuation. B2B contracts and enterprise mandates are offered as the reason a tool can persist after some individual developers say they have moved on. The argument matters because it frames the auto-install as a business-model outcome rather than a one-off bug.
Bruno becomes the preferred exit
Bruno is repeatedly recommended as a local, open-source alternative that keeps data on the user's infrastructure. Insomnia is qualified because it forces a cloud account, while curl plus bash remains the baseline for command-line users. A healthcare cyber team decertified Postman and the organization switched to Bruno overnight, an example of rapid migration when compliance is involved.
GUI clients still fit some workflows
A counterargument says curl is not a universal replacement: GUI clients store and manipulate requests, format response bodies and help developers who do not know curl. The debate is about workflow fit, not whether curl is technically capable. This qualifies the CLI-first advice and points to why GUI clients remain in use despite the bloat.
LLM-assisted forking as an exit
The right to fork, combined with LLMs, is seen as making it easier to remove corporate antifeatures and republish tools such as Mattermost, Stats and Bitwarden, possibly through a nonprofit. Others describe building personal replacements for software that can be enshittified. The nonprofit idea is floated as one vehicle for that work.
Vibe-coded replacements raise security concerns
A skeptical reply argues that one-off AI-generated programs are hard to secure, audit and maintain, comparing them to load-bearing Excel sheets that outlive their authors. The preference is for battle-tested software that can be extended with AI, not rebuilt for every conversation. This qualifies the optimism about forking and personal software.
Security teams decertify Postman
A healthcare cyber team decertified Postman and the organization switched to Bruno overnight, while the sales team continued to call. The auto-install issue therefore moves beyond developer annoyance into enterprise compliance risk, where a single unauthorized configuration change can trigger removal.