Hub/AI Security/Advisories/postman-autoinstall-2026
Postman Desktop auto-installs Codex / Claude Code plugins and pre-trusts its own startup hook
Users report Postman's auto-existing-upgrade step installing Postman plugins into Claude Code and Codex, writing a trusted hook hash into Codex config, adding a SessionStart hook, the remote MCP server mcp.postman.com and a CLI in ~/.local/bin. Postman staff replied on Nov 3 that opt-in will be made clearer and hook approval is under review. No CVE.
| Published | Oct 25, 2026 |
|---|---|
| Severity | Not Rated |
| CVE | None assigned |
| Status | open |
| Affected | Not listed |
| Fixed in | Not listed |
| Component | Postman Desktop 12.33.4–12.35.1 |
Sources
- https://github.com/postmanlabs/postman-app-support/issues/14370
- https://news.ycombinator.com/item?id=50354960
Checked 2026-11-04. We copy severity and fix versions from the source and never estimate them.
Affected tools
Weekly, free
What changed in AI integrations
One short email when MCP clients, plugin ecosystems, IDE integrations, AI plan prices or security advisories change. Every item is sourced.