Postman Gives Its Users One Sentence on a Download Page. To Their AI Coding Assistants It Sends a Mandate Marked “EXTREMELY_IMPORTANT”

Software has always written for people: installers, permission dialogs, release notes. A report about Postman, a widely used app for testing web APIs, shows a second reader. When the app sets itself up inside a developer’s AI coding assistant, it addresses the assistant directly, and the two messages, one for the person and one for the machine, are not written with the same emphasis.

On 25 October the GitHub user indicava opened issue 14370 in Postman’s support repository, titled “[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook”. The log of Postman 12.33.4 on that user’s Mac recorded, on 24 October, an install with the source “auto-existing-upgrade” and the results “claude-code:installed” and “codex:installed”. On 3 November a second user, ronthedrummer, reported the same path when the app updated itself from 12.31.3 to 12.35.1: the Postman command-line tool and the plugins for Claude Code and Codex were installed, and Cursor already had the plugin. Both are reports from a single Mac each. We did not install Postman to reproduce them.

The plugin is open source, so the text the assistants receive can be read. The file hooks/session-start-context.md opens with the tag <EXTREMELY_IMPORTANT> and continues: “You have the Postman plugin. Before responding to any non-trivial API engineering task […] load the postman:api-engineer skill and follow it.” A hook prints it when a session starts, is cleared or is compacted. The script that does this describes itself as printing “the session-start mandate”, and the developers use the same word in their commits: on 20 October a fix for GitHub’s Copilot CLI was titled “deliver the session-start mandate”, because Copilot had been dropping the plain text, and it added a check in the automated tests that the text gets through. The installer has separate code for nine assistants: Antigravity, Claude Code, Codex, Copilot CLI, Cursor, Factory Droid, Kimi Code, OpenCode and Pi.

The text itself is not hidden, and it is not unlimited. It exempts pure questions and trivial one-line edits, and its last line says that the user’s instructions, in project files such as AGENTS.md or CLAUDE.md or in direct requests, take precedence over “this mandate”. It has been in the repository since 21 September, and anyone who installs the plugin on purpose gets the same words. What the two reports dispute is who decided to put them in front of their assistants.

Codex, OpenAI’s coding assistant, normally asks the user to approve a plugin’s hook before running it; a Postman commit notes that, until the user did, “the mandate was missing”. The plugin’s README says that for Codex “installation also approves Postman’s session-start hook” and that “there is no separate hook prompt”. The code that does it was added on 21 October in a commit titled “auto-approve Postman’s Codex hook”: a function called approvePostmanHook writes the hook’s trusted hash into Codex’s settings. On the first Mac a trust record is present, though the reporter writes that this alone does not prove who created it. On the second there is none, and the user says he did not check whether the hook ran in Codex. In Cursor, he writes, the same text is injected into agent sessions.

For people, the notice is shorter. A reply posted in the issue on 3 November at 23:36 UTC, 00:36 on 4 November in Italy, by the account zecoquit, says “we bundle the Postman CLI and the agent plugins with the desktop app” and “We mention this on the download page and in the app update flow”, and promises to make the opt-in clearer, “especially for existing users”, and says the hook approval and session-start behavior are under review. It is written in Postman’s voice, but the account’s profile names no employer and GitHub does not mark it as a member or collaborator of the repository, so we cannot confirm it speaks for the company. Postman’s download page today says: “The Postman app includes Postman CLI & Postman plugins, so you can use Postman from your terminal.” In the Internet Archive’s copy of the same page from 26 October at 09:07 UTC, two days after the first logged install, that sentence is not there. A commenter in the issue had pointed this out; we checked both versions. We could not see the update flow.

One claim did not hold up in the sources. The Hacker News headline that brought the issue more than 1,000 points says that Postman “attempts to share all API data”. Neither report says so: the first states that it does not claim to establish data exfiltration, and the second ends “I do not have evidence that data was uploaded.” The plugins configure a connection to a Postman server, mcp.postman.com, which in both reports was still asking for authentication.

What we checked is limited to public material: the plugin’s code at commit 9d5544f, its history, the issue and its comments, and the two versions of the download page. We did not see how many users received the automatic install or which feature flag enabled it; the logs mention one without naming it. What the material does show is the gap between the two notices. The one for people is a sentence on a page that existing users do not have to open when the app updates. The one for the machine arrives at the start of every session, marked as extremely important, and its delivery is checked assistant by assistant.