Postman Auto-Installs AI Plugins and Shares API Data
First merged summary.
Postman desktop app auto-installs AI plugins into coding agents and shares all API data without consent, per reports.
A developer reported that Postman silently installed plugins into Claude Code and OpenAI Codex without permission. The app auto-approved its startup hook for Codex, directing it to use Postman tools for API tasks, and installed a matching Postman CLI executable. Reports indicate the app attempts to share all API data, but no evidence of collection or transmission was found. Postman claims the installer can approve hooks per documentation but did not respond to requests for comment. Developers want explicit review and full removal of changes.
- Plugins installed into Claude Code and OpenAI Codex without consent
- Auto-approved startup hook for Codex
- Postman CLI executable installed with matching timestamps
- Attempts to share all API data without user consent
- No evidence of data collection or transmission found
- Postman did not respond to requests for comment
What each outlet adds
beyond the shared facts- Hacker NewsPostman attempts to share all API data without user consent
- LobstersAuto-approves startup hook for Codex, installed Postman CLI, no evidence of data transmission, company claims per documentation
- Vendors
- Postman
- Victims
- developer indicava
- Organizations
- Postman Labs
Coverage
oldest first · one row per article · UTC- · 6d ago
Hacker News · AIFirst report
Postman silently installs AI plugins and shares API data
Postman auto-installs AI plugins and shares all API data without user consent.
- · 5d ago
Lobsters · security
Postman desktop app installs plugins into AI coding agents without permission
Postman’s installer auto-approves its own startup hook for Codex, raising consent concerns for developers.