AI Coding Agent Plugin Security: Lessons from Postman

You open a desktop app you have used for years, and while you are getting on with your day it quietly edits the configuration of two other tools on your machine. That is what a developer reported in late October about the Postman desktop app: according to the GitHub issue summarised by RuntimeWire, simply running the app installed Postman plugins into OpenAI Codex and Anthropic Claude Code without asking. Whatever you think of the specifics, it is a sharp reminder that AI coding agent plugin security is now part of your workstation's attack surface, and that you need a way to audit it.

This article walks through what was reported, what Postman has said, why agent configuration is such a sensitive place, and a practical checklist you can run today.

What was reported

The details below are the reporter's claims, as quoted in write-ups by Gabriel Anhaia on DEV and Neoteric. Postman has not confirmed each one individually.

• The reporter was running Postman desktop 12.33.4 on a Mac. Postman's own log recorded the plugin install script completing with a source of auto-existing-upgrade, with Claude Code and Codex both marked as installed.
• In Codex's ~/.codex/config.toml, a Postman marketplace entry and an enabled Postman plugin appeared, along with an entry under [hooks.state] containing a trusted hash.
• In Claude Code's ~/.claude/settings.json, a Postman plugin was enabled, and a Postman CLI appeared in ~/.local/bin.
• The plugin registered a SessionStart hook: a small script that runs whenever an agent session starts, clears or compacts, and injects context nudging the agent to load a Postman skill for API work.

The part that drew the most attention is the hook approval. Codex asks you to trust a hook before it runs. Both write-ups point to installer code in Postman's open-source plugin repository that writes that trust record itself, with a source comment saying it "approves only Postman's current hook after installation". Both authors are careful to say the code shows an attempt to pre-approve the hook, and that the record on its own does not prove who wrote it.

What was not shown matters just as much. The Hacker News headline talked about sharing API data, but Neoteric notes the report "does not claim to establish data exfiltration", and the remote MCP connection the plugin configured reportedly failed with an authentication error. This is a consent and configuration story, not a confirmed data leak.

What Postman has said

RuntimeWire reports that Postman's head of product said on 3 November that the company "will make the opt-in clearer" for its AI coding agent plugins, especially for existing users. Postman also said it bundles its CLI and agent plugins to make setup easier, and that it is reviewing the hook approval and session-start behaviour that was flagged. According to the DEV write-up, the components can be uninstalled from inside the app.

That is a reasonable response, and it is fair to say the intent looks like convenience rather than anything malicious. But intent is not the control you rely on. Configuration is.

Why agent configuration is a high-value target

An AI coding agent is not just an editor. Depending on how you have set it up, it can read your repositories, run shell commands, call APIs and talk to remote MCP servers. Its configuration decides what instructions it receives before you type anything.

That makes three things especially sensitive:

1. Hooks. A session-start hook runs code and shapes the agent's context every time you open a session. A trust prompt exists precisely so that you, not a third party, decide which hooks run.
2. MCP servers. Each one is a new place your agent can send requests and receive instructions from. A remote server you did not choose is a trust decision someone else made for you.
3. Skills and injected context. Text injected into the agent's context is, in effect, a standing instruction. My earlier article on prompt injection in AI agents covers why agents tend to trust too much; the same reasoning applies when the "instruction" arrives via a plugin rather than a web page.

None of this is unique to Postman. Any tool that can write to your home directory can, in principle, register itself with your agents. The lesson is to treat agent config like you treat SSH keys or CI secrets: something you review, not something you assume.

A practical audit checklist

These are read-only checks based on the paths named in the reports. Adapt the paths to your operating system.

1. Look for unexpected Postman entries

grep -n -i postman ~/.codex/config.toml
grep -n -i postman ~/.claude/settings.json
grep -i postman ~/.claude/plugins/installed_plugins.json
ls -l ~/.local/bin | grep -i postman

If you use Claude Code, claude plugin list shows what is installed and enabled.

2. Review hooks and trust records

Open the [hooks.state] section of your Codex config and check every trusted hash against a hook you remember approving. In Codex, the /hooks command lets you see and disable hooks.

3. List every MCP server your agents can reach

For each one, ask: did I add this, do I still need it, and what credentials can it use? Remove anything you cannot account for.

4. Remove what you did not choose

The DEV write-up lists claude plugin disable or claude plugin uninstall for the Postman plugin in Claude Code, and disabling the hook via /hooks in Codex. Neoteric's advice is to remove entries by hand and diff your config before and after, rather than running a removal script you have not read.

5. Put agent config under change control

Keep a copy of your agent config files in a private dotfiles repository, or at least snapshot them. A simple diff against yesterday's version turns "something changed silently" into "I can see exactly what changed".

A decision framework for API tools that touch client work

If you handle client APIs, keys or customer data, a quick rule of thumb helps:

• Low risk: the tool only reads and writes its own data directory. Keep it, update it normally.
• Medium risk: the tool syncs workspaces or collections to the cloud. Check where data is stored, who can see it, and whether sensitive environments can stay local.
• High risk: the tool modifies other tools' configuration, registers hooks or adds MCP servers. Review every change, and prefer tools that ask first.

For client engagements, a separate user profile or virtual machine with a minimal agent setup keeps one client's credentials away from another's and away from plugins you have not vetted.

The common mistake, and the fix

The mistake: assuming that because you never installed a plugin, you do not have one. Auto-updates, bundled components and "helpful" installers all change your environment without a moment where you consciously said yes.

The fix: make your agent's configuration observable. Check it after major app updates, keep it under version control, and treat any new hook, skill or MCP server as a change that needs a reason. Ten minutes of auditing beats discovering months later that your assistant has been taking instructions from somewhere you never chose.

Key takeaways

• A developer reported that Postman desktop auto-installed plugins into Codex and Claude Code and pre-approved its own startup hook; Postman says it will make the opt-in clearer.
• No data exfiltration has been demonstrated, but unasked-for hooks and MCP servers are a real trust problem.
• AI coding agent plugin security depends on hooks, MCP servers and injected context, so audit all three.
• Use read-only grep checks, review trust records and keep agent config under version control.
• Treat any tool that edits other tools' configuration as high risk, especially on machines used for client work.

FAQ

Did Postman steal API data?

Nothing in the sources shows data leaving anyone's machine. The reports describe unwanted configuration changes, and the remote MCP connection reportedly failed to authenticate. It is still worth auditing and removing anything you did not choose.

Do I need to stop using Postman?

Not necessarily. Check whether the plugins were installed on your machine, remove them if you do not want them, and watch for Postman's promised clearer opt-in. Apply the same scrutiny to every tool with access to your agents.

How often should I audit my AI agent configuration?

After any major update to a tool that integrates with your agents, and on a regular schedule otherwise. Version-controlling the config files makes each check a quick diff rather than a manual hunt.

If you want a second pair of eyes on how your development tools, web systems or AI workflows handle trust and data, take a look at my cyber and e-commerce security service or get in touch. I enjoy turning messy "what is actually running here?" questions into clear, fixable checklists.