Postman silently auto-installs AI plugins and attempts to share all API data
A highly discussed GitHub report alleges that a Postman desktop update installed agent integrations and altered local configurations without consent.
TL;DR
- A GitHub issue alleges that Postman Desktop installed Codex and Claude Code integrations and changed agent configuration when the application opened.
- The issue’s author describes a remote MCP connection and an attempted trust change; Hacker News discussion drew substantial engagement.
- The report is one user’s documented case, and the claim that API data was shared is not established by the available evidence.
A user report filed on GitHub says opening Postman Desktop on macOS was followed by installation of Codex and Claude Code plugins and changes to agent configuration. The issue is titled “Postman silently auto-installs AI plugins and attempts to share all API data.” [2]
The reporter also describes a remote MCP connection and an attempted change to Codex hook trust. The Hacker News discussion shows developer reaction to the report, but comments are not independent reproductions. [1] [2]
The available record rests on one user’s account of a single machine and software version. It does not provide evidence that API data was actually collected or transmitted externally. [2]
A Postman response and independent reproduction are not established in the cited coverage. The scope and cause of the installation behavior, and whether users can fully reverse it, remain open. [1] [2]
Why it matters
Developer applications that modify agent configuration can affect which instructions and services an agent uses. The report raises a consent question, while its broader claim about API data handling remains unverified.
Editor's note
Treat the GitHub report as an allegation from one installation; no independent reproduction or Postman response is cited here.