341 points114 comments
Postman silently installs AI plugins and hijacks your API data
What is Postman silently auto-installs AI plugins and attempts to share all API data?
The Postman desktop client is auto-installing Codex and Claude extensions without asking. It then routes API calls through those plugins and tries to approve its own startup hook, exposing your API traffic.
Who it is for
Developers using Postman should audit their install and remove the unauthorized plugins to protect their API credentials.