Postman Signed Its Own Permission Slip

The real news

The story, straight

Postman helps developers test how apps exchange requests and answers. Codex and Claude Code are coding assistants.

Plugins add capabilities; startup hooks run instructions when an assistant starts.

Now imagine a delivery company signing its own permission slip to rearrange your office.

GitHub issue 14370, opened 2026-10-25 and analysed by DEV Community on 2026-11-03, documents a user's signed-in Mac installation. Their logs show opening Postman triggered an automatic upgrade path that installed Postman plugins into Codex and Claude Code, plus a command-line tool.

Codex also gained instructions to load Postman's guidance before substantial work on how apps communicate. That is broader than waiting for someone to ask for Postman.

The sharpest detail is independently checkable: Postman's installer writes the trust record approving its own Codex startup hook. Its documentation describes approval without a separate prompt.

The permission slip arrives already signed. By the delivery company.

Keep the limits: the reported automatic installation has not been reproduced on a clean Mac. No data theft was demonstrated; the reported remote connection failed authentication.

Postman's 2026-11-03 response says bundling makes setup easier, is disclosed on its download page and update flow, and can be undone inside the app. It promises clearer opt-in and a review of hook behaviour.

Useful move: inspect your assistants' installed plugins and startup settings. Convenience should save clicks, not impersonate consent.

Repost if permission slips still require somebody else's signature.

Thanks for supporting Lil'meme. Your support is appreciated.