Postman silently auto-installs AI plugins and attempts to share all API data

A GitHub issue reports that opening Postman desktop 12.33.4 on macOS triggered automatic installation of Postman plugins into Codex and Claude Code, a user-wide startup hook instructing agents to load Postman skills for broad API engineering tasks, and a remote MCP connection to mcp.postman.com/mcp that failed with "Auth required." The report cites Postman's own log recording an "auto-existing-upgrade" install and installer source code that calls config/batchWrite to set a trusted_hash for its own hook, which the author frames as a consent and trust-boundary problem while stating it does not claim data exfiltration.