Postman 12.33.4 and 12.35.1 auto-installed plugins for Claude Code, OpenAI Codex, and GitHub Copilot CLI on macOS — without user consent, notification, or opt-in. The change appeared in logs on October 24 and November 3 respectively, and affected developers using those AI coding agents alongside Postman’s desktop app. Users discovered the additions when startup hooks triggered silently: Codex began loading postman:api-engineer before responding to API tasks.

Claude Code enabled the postman@claude-plugins-official plugin in settings.json. And Copilot CLI listed Postman among detected agents, even though no installation step was initiated by the user. A failing Auth required error from Postman’s MCP server surfaced in Codex logs, revealing the plugin tried (and failed) to connect without sign-in. Postman confirmed the behavior in a November 5 GitHub reply, calling it an attempt to “make setup easier” and announcing a reversion, but clarified that reverting does not uninstall what’s already present.

The company added a notice to its download page stating “the Postman app includes Postman CLI & Postman plugins,” a line absent from archived versions as of October 26. Uninstall instructions are now documented: users can remove the plugin via Postman’s Help menu, run npx @postman/postman-plugin remove, or manually delete entries from.claude/settings.json,.codex/config.toml, or.copilot directories.

All confirmed cases so far are on macOS. No evidence of data collection has been found. Postman says it will redesign the experience with “the right level of control.” The fix is rolling out in upcoming desktop updates, but until then, developers must audit their AI agent configs themselves.