Postman desktop auto-installed its plugins into users' Codex and Claude Code

A GitHub issue opened on 25 October reports that opening the Postman desktop app on a Mac automatically installed Postman plugins into Codex and Claude Code, a remote Postman MCP connection, the Postman CLI, and a startup hook telling the coding agent to load Postman's API skill before any non-trivial API task. Postman's own log recorded it as an automatic upgrade for an existing user, and the reporter found installer code that tries to approve its own Codex hook. A second user saw the same on version 12.35.1 on 3 November; neither report claims evidence that data was uploaded. A reply in the thread speaking for Postman said the tools are bundled to make setup easier, are mentioned on the download page and in the update flow, can be uninstalled inside the app, and that Postman will make opt-in clearer for existing users and review the hook behaviour. On Hacker News (67 top-level comments when we read it) none defended the auto-install, Bruno was the most named replacement (8 comments), and one commenter in healthcare said their security team had decertified Postman. Sorted take: a desktop app can now rewrite your coding agent's instructions, so review agent configs the way you review browser extensions.