--- title: A developer opened Postman. Then two AI coding agents... description: Postman's desktop app reportedly installed plugins into Claude Code and OpenAI Codex without the user's permission. A developer known as 'indicava' reported... canonical: https://daily.dev/posts/a-developer-opened-postman-then-two-ai-coding-agents-changed-without-their-permission--9ecifbvzp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A developer opened Postman. Then two AI coding agents changed without their permission. | daily.dev og:description: Postman's desktop app reportedly installed plugins into Claude Code and OpenAI Codex without the user's permission. A developer known as 'indicava' reported... og:url: https://daily.dev/posts/a-developer-opened-postman-then-two-ai-coding-agents-changed-without-their-permission--9ecifbvzp og:image: https://api.daily.dev/og/posts/9ECIFbVzP.png og:image:alt: A developer opened Postman. Then two AI coding agents changed without their permission. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A developer opened Postman. Then two AI coding agents changed without their permission. **[The New Stack](https://daily.dev/sources/newstack)** · 15 min read · 0 upvotes · 0 comments ## Summary Postman's desktop app reportedly installed plugins into Claude Code and OpenAI Codex without the user's permission. A developer known as 'indicava' reported the issue on GitHub on October 25, after Codex started showing authentication errors and repeatedly loading Postman skills unprompted. Opening Postman desktop version 12.33.4 on macOS triggered an installation event on October 24 that added plugins, a new plugin marketplace, and a trusted session-start hook to Codex's config.toml. Postman's installer can auto-approve that hook, skipping the manual review Codex normally requires. It also set up a connection to Postman's remote MCP server, though Codex failed to authenticate. The developer says Postman's uninstall command isn't enough to undo the changes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is Codex showing authentication errors and loading Postman skills I never asked for? Postman's desktop app (version 12.33.4 on macOS) can auto-install plugins into Codex and Claude Code without explicit user permission. An installation event logged as 'auto-existing-upgrade' added an enabled Postman plugin, a new plugin marketplace, and a trusted session-start hook to ~/.codex/config.toml, while the configured remote MCP connection at mcp.postman.com repeatedly failed to authenticate. _Developers auditing unexpected agent config changes can track reports like this one on daily.dev._ ### How does Postman get Codex to trust its plugin hook without manual approval? Postman's installer checks whether Codex already trusts the hook, and if not, uses config/batchWrite to add the hook's trusted hash directly to Codex's configuration, skipping the manual review developers face when installing the plugin through Codex directly. It verifies the hook hasn't changed before approving it, and logs a warning if approval fails. _Anyone weighing how much control to hand third-party plugins over AI agents can follow this story on daily.dev._ ### Does uninstalling the Postman plugin from Codex fully remove its changes? No, Postman provides an uninstall command but it does not fully reverse the changes. The affected developer reported that removing the integration should also clear agent settings, trusted hooks, MCP connections, and installed CLI tools, none of which the current uninstall process addresses. _Developers cleaning up unwanted agent integrations can keep tabs on fixes to this issue via daily.dev._ ## Similar posts on daily.dev - [Malicious downloads can trick AI coding agents into compromising themselves](https://daily.dev/posts/malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves-pvuaks4l2) · CSO Online · 0 upvotes · 1 comments - [Popular Codex npm package stole developer tokens for a month](https://daily.dev/posts/popular-codex-npm-package-stole-developer-tokens-for-a-month-szppthxmu) · The Next Web · 1 upvotes · 1 comments - [Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents](https://daily.dev/posts/mozilla-shows-the-danger-of-indirect-prompt-injections-in-ai-coding-agents-nqhoyxkhl) · DevOps.com · 0 upvotes · 0 comments - [StepSecurity Now Inventories AI Agent Plugins in Your GitHub Repositories and on Developer Machines](https://daily.dev/posts/stepsecurity-now-inventories-ai-agent-plugins-in-your-github-repositories-and-on-developer-machines-siwkedecn) · StepSecurity · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#mcp](https://daily.dev/tags/mcp), [#claude-code](https://daily.dev/tags/claude-code), [#openai-codex](https://daily.dev/tags/openai-codex), [#postman](https://daily.dev/tags/postman) [View this post on daily.dev](https://daily.dev/posts/a-developer-opened-postman-then-two-ai-coding-agents-changed-without-their-permission--9ecifbvzp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A developer opened Postman. Then two AI coding agents changed without their permission.","url":"https://daily.dev/posts/a-developer-opened-postman-then-two-ai-coding-agents-changed-without-their-permission--9ecifbvzp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-developer-opened-postman-then-two-ai-coding-agents-changed-without-their-permission--9ecifbvzp"},"datePublished":"2026-11-03T23:19:12.495Z","dateModified":"2026-11-03T23:48:25.280Z","description":"Postman's desktop app reportedly installed plugins into Claude Code and OpenAI Codex without the user's permission. A developer known as 'indicava' reported...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0045922f202ef0eba3eda69fd0d1c51d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0045922f202ef0eba3eda69fd0d1c51d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-developer-opened-postman-then-two-ai-coding-agents-changed-without-their-permission--9ecifbvzp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,mcp,claude-code,openai-codex,postman","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"A developer opened Postman. Then two AI coding agents changed without their permission."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-developer-opened-postman-then-two-ai-coding-agents-changed-without-their-permission--9ecifbvzp#faq","mainEntity":[{"@type":"Question","name":"Why is Codex showing authentication errors and loading Postman skills I never asked for?","acceptedAnswer":{"@type":"Answer","text":"Postman's desktop app (version 12.33.4 on macOS) can auto-install plugins into Codex and Claude Code without explicit user permission. An installation event logged as 'auto-existing-upgrade' added an enabled Postman plugin, a new plugin marketplace, and a trusted session-start hook to ~/.codex/config.toml, while the configured remote MCP connection at mcp.postman.com repeatedly failed to authenticate. Developers auditing unexpected agent config changes can track reports like this one on daily.dev."}},{"@type":"Question","name":"How does Postman get Codex to trust its plugin hook without manual approval?","acceptedAnswer":{"@type":"Answer","text":"Postman's installer checks whether Codex already trusts the hook, and if not, uses config/batchWrite to add the hook's trusted hash directly to Codex's configuration, skipping the manual review developers face when installing the plugin through Codex directly. It verifies the hook hasn't changed before approving it, and logs a warning if approval fails. Anyone weighing how much control to hand third-party plugins over AI agents can follow this story on daily.dev."}},{"@type":"Question","name":"Does uninstalling the Postman plugin from Codex fully remove its changes?","acceptedAnswer":{"@type":"Answer","text":"No, Postman provides an uninstall command but it does not fully reverse the changes. The affected developer reported that removing the integration should also clear agent settings, trusted hooks, MCP connections, and installed CLI tools, none of which the current uninstall process addresses. Developers cleaning up unwanted agent integrations can keep tabs on fixes to this issue via daily.dev."}}]} ```