Postman silently auto-installs AI plugins and attempts to share all API data
This incident highlights a new class of security and consent risks where third-party software silently modifies local AI agent configurations and instructions to hijack workflows.
Reported by Hacker News ·
What happened
A developer reported on GitHub that the Postman desktop application silently installed plugins and remote MCP connections into their local Claude Code and Codex AI coding agents without consent. Furthermore, the Postman installer bypassed security boundaries by self-approving its own startup hooks, forcing the coding agents to route general API engineering tasks through Postman.
Who it’s about
- Postman
- Claude Code
- Codex
Source
More on security
Get a brief picked for you
Sign in to follow topics and companies, save stories and search the archive.
Sign in