Postman users say it silently installed AI plugins and tried to share API data
Postman is a popular app developers use to build and test APIs, the connections between pieces of software. API requests often carry keys and passwords. So what Postman does with that data matters a lot.
A GitHub issue titled 'Postman silently auto-installs AI plugins and attempts to share all API data' is today's top story on Hacker News, with 1,314 points and 447 comments. That is the claim in the issue. Our sources do not include Postman's answer, so treat the details as a user report for now.
On Saturday, we saw an official Claude Code extension backdoored by attackers. Here, nobody is accused of hacking. The worry is different: a trusted tool that adds AI and moves data without a clear yes from the user.
When AI arrives through a silent update, your secrets can leave with it. If your team uses Postman, check its AI settings and what it syncs today, and change your keys if you are unsure. Then ask every vendor one simple question: what did you turn on without asking me?
