Postman says it will make opt-in clearer after users found its desktop app installing plugins into Claude Code and Codex without asking

A developer reported on Postman's GitHub tracker that opening Postman desktop 12.33.4 on a Mac installed Postman plugins into OpenAI's Codex and Anthropic's Claude Code, plus a startup instruction telling Codex to use Postman's skills for API work. Postman's own log records the install as automatic on upgrade, and the installer's code tries to mark that instruction as trusted, a review Codex normally leaves to the user. Another user saw the same after updating to 12.35.1. Postman head of product Sarabmeet Kallar told RuntimeWire, via a PR agency, that bundling eases setup, that Postman will make opt-in clearer, especially for existing users, and that it is reviewing the trust and startup behavior. The report does not claim data was exfiltrated.

Written by dalao.ai: the title, summary and why it matters are our own words. The original reports are the record; their publishers keep authorship.