Postman accused of automatically installing AI plugins and modifying coding agent configurations
Understand this story
A user reported in a GitHub issue that after opening Postman desktop version 12.33.4, Postman automatically installed plugins for Codex and Claude Code and wrote startup hooks and remote MCP connections. The logs provided by the user show the installation source as "auto-existing-upgrade", with both claude-code and codex marked as installed. The user stated that this report can only prove that unwanted integrations and instruction changes occurred, and cannot prove that data exfiltration took place; the sequence of operations has not yet been reproduced on a clean Mac. The user said they have uninstalled the local Postman and its integrations after preserving evidence.
AI overview based on source reports · Updated 3 days ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Hacker News AIPostman silently auto-installs AI plugins and attempts to share all API data
A GitHub issue reports that opening Postman desktop 12.33.4 on macOS triggered automatic installation of Postman plugins into Codex and Claude Code, a user-wide startup hook instructing agents to load Postman skills for broad API engineering tasks, and a remote MCP connection to mcp.postman.com/mcp that failed with "Auth required." The report cites Postman's own log recording an "auto-existing-upgrade" install and installer source code that calls config/batchWrite to set a trusted_hash for its own hook, which the author frames as a consent and trust-boundary problem while stating it does not claim data exfiltration.
Activity for this story
- Current comparable activity
- 3
- Peak comparable activity
- 10Nov 4 02:00
- Change in the past 24 hours
- -51%
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.