Postman's silent AI plugins break the one rule dev tools can't

How much do you trust the app where you paste your production tokens? Most developers never ask, because API clients live in the same mental drawer as the terminal: boring, local, ours. That's exactly why the latest Postman uproar hit so hard.

What happened, as far as we can tell

A report on the Postman support tracker on GitHub, filed November 3, is titled "Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook." According to AI Weekly, opening Postman desktop 12.33.4 installed its plugins into Codex and Claude Code. It reportedly modified ~/.codex/config.toml and ~/.claude/settings.json without explicit opt-in.

The report also made the rounds on Hacker News. Several secondary write-ups say the app tries to share API data with Postman's AI services too. Those claims are, for now, allegations from a support-tracker report and community posts. We haven't seen a Postman statement in our documentation, so treat the data-sharing part as unconfirmed.

The config file is the crime scene

Even if you set the data question aside, the plugin installation is the part we find hardest to defend, assuming the report holds up. One analysis, from explainx.ai, points out that the instruction applies to "any non-trivial API engineering task." The setting sits in the user-wide config, so every project inherits it. That means a tool you opened to debug one endpoint may shape your AI assistant's behavior across unrelated work.

This would not be a feature toggle in Postman's own window. It would be a tool reaching into other tools' settings. We'd say that's the real offense, and a "we only meant to help" defense doesn't cover it. Your editor, your shell and your agent configs are yours. Another vendor's installer doesn't get to write there on a hunch that you'll like it.

The same analysis notes that the plugin also wires in a hosted MCP endpoint, which it describes as a path for data to leave the machine once authentication succeeds. We'd keep the language measured: a path isn't a leak. But developers weren't asked whether they wanted the path built.

Opt-in isn't friction, it's the product

Product teams hear "ask first" and picture a conversion funnel with a hole in it. We think that's backwards for developer tools. Postman's value is that people put real things in it: tokens, customer payloads, internal systems. One dev.to guide warns that if you send production tokens, customer payloads or health records through Postman, default-on AI features matter. That's a community claim, not a verified finding. But it describes the right risk model.

An API collection is closer to a credentials vault than to a document. It maps your systems and often carries the keys. Our position is simple: collections should be treated like secrets, and anything that reads, syncs or summarizes them should need a deliberate yes from the user. Not a buried setting, and not a changelog line.

There's also a commercial argument. Enterprises are already nervous about AI access. A TCS study of 1,333 senior leaders found security, risk and governance rank as the top factor shaping how AI is developed and deployed, ahead of cost, speed and ease of deployment. Security teams reading this thread will probably not remember the clever agent integration. They'll remember the report that a client modified config files unasked. Procurement conversations get harder from there.

What to do now

If you use Postman desktop, we'd check those two config files and the AI settings before your next session. One Hacker News thread entry says older versions are fine, but that's a single comment, so verify it yourself. Rotate any token that may have passed through an affected build if your threat model demands it. Consider keeping sensitive collections out of any cloud-synced workspace.

For vendors, the lesson is cheap. Ship AI features off by default, show exactly what will be installed or sent, and never touch another tool's configuration without a prompt. Our verdict: if the reports are accurate, Postman may well have meant this as convenience, and it still reads as a breach of manners that developers will interpret as a breach of trust. Trust is the only thing a tool that holds your keys really sells.