Postman caught silently auto-installing AI plugins and attempting to share all API data
sidgarimella · hn · 2026-11-04
A trending HN post reports that the Postman desktop app silently auto-installs AI plugins and attempts to share users' API request data — potentially including sensitive credentials — with Postman.
The author links to the official postman-app-support issue (#14370). The episode raises trust concerns about tools enabling AI features by default and exfiltrating data without clear consent, and serves as a practical reminder for developers who store API credentials in Postman to audit their settings.
More from Safety
- ARTEX red team tool's Docker image found to contain an unauthorized backdoor — Kyrannio · 2026-11-04
- India's CERT-In gets Anthropic's Claude 'Mythos' to probe cybersecurity flaws, skeptics unimpressed — kingslyj · 2026-11-04
- Ternary Logic proposal: enforcing AI safety at the architecture level — MoralLogs · 2026-11-04
- Cambridge's David Krueger: A global AI pause needs coordination, not trust — DavidSKrueger · 2026-11-04
- Security advisory: run AI agents in managed cloud environments, not employee endpoints — amasad · 2026-11-04
- Man who siphoned 4M accounts' credits from AI platform reselling them gets suspended sentence — 葬AI · 2026-11-04