{
  "id": 18242563,
  "title": "Postman, Claude Code, and the Plugin You Never Installed",
  "url": "https://urgent.news/2026/11/05/postman-claude-code-and-the-plugin-you-never-installed",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-05T03:52:55.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ali_82f3409ed625e8ba8515b/postman-claude-code-and-the-plugin-you-never-installed-2923"
  },
  "original_language": "en",
  "account": null,
  "summary": "In October 2026, a developer reported that updating Postman to version 12.33.4 silently installed plugins into Claude Code and Codex, and registered its startup hook as trusted. The report highlights that a coding agent, which runs with your credentials and codebase, can be altered by this change, potentially affecting how it handles API work. The key takeaway is that Postman 12.33.4 allegedly installed its own plugins into Claude Code and Codex during an ordinary app update, adding a SessionStart hook that steers API work towards Postman's skill without explicit user consent. While the report provides evidence of changes to config files and plugin directories, it does not confirm whether API data was shared. The incident raises concerns about the implications of silent plugin installations in coding agents, as it represents a change to the agent's behavior that occurs before any user interaction.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}