Postman, the API development platform used by millions of developers, is facing a wave of community backlash after a developer published detailed evidence that its desktop app silently installs AI plugins into unrelated coding tools — and writes configuration that steers those agents' work toward Postman.
The controversy exploded into the mainstream on Monday, when a Hacker News post titled "Postman silently auto-installs AI plugins and attempts to share all API data" drew nearly 800 upvotes within hours, becoming one of the community's most-discussed stories of the day. The underlying evidence is a public GitHub issue filed on Postman's official support tracker on October 25, which remains open. For more context on this story, see our ongoing AI trends.
What the Developer Found
The issue, titled "[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook," was filed by a developer running Postman 12.33.4 on macOS. After opening Postman, they noticed unexpected behavior in their AI coding agents: recurring MCP authentication warnings and OpenAI's Codex repeatedly routing API work through Postman skills.
Digging in, the developer found a user-wide Postman plugin, a startup instruction hook, a remote MCP connection, a Claude Code plugin, and a separately installed Postman CLI — none of which they had chosen to install.
The evidence in the issue is unusually concrete. Postman's own log file, at a specific timestamped location, records the automatic installation: a JSON entry with the source "auto-existing-upgrade" and the results "claude-code:installed" and "codex:installed," followed by a log line reading "Main: autoInstall.plugin.existing-user finished."
The developer's global Codex configuration file was also modified. The issue shows new sections added to `~/.codex/config.toml` — a Postman marketplace pointing at Postman's plugin repository, and an entry enabling the `postman@postman` plugin.
The Startup Hook
The most contentious finding concerns what the plugin does after installation. The issue documents that the installed plugin registers a hook that fires on agent startup — matching the startup, clear, and compact session events — and prints instructions into the agent's context.
Those instructions direct the AI agent to load Postman's "api-engineer" skill before responding to "any non-trivial API engineering task," a category that includes designing, implementing, mocking, testing, monitoring, documenting, or deploying an API. In effect, any API work the developer asks their coding agent to do would be routed through Postman's workflow, whether or not the developer uses Postman.
The configuration written during installation also included trusted-hash entries for the hook itself — records that tell the agent system the startup hook is approved. The developer characterized this as the installer "attempting to approve its own instruction hook," and framed the overall behavior as a severe consent and trust-boundary problem. "An API client should not make itself the default workflow in other tools simply because I opened it," the issue reads.
Why It Struck a Nerve
The Hacker News discussion and follow-up commentary show why the story resonated beyond a single tool's user base. AI coding agents like Codex and Claude Code are increasingly granted broad access to developers' systems, with configuration files, hooks, and MCP connections determining what context they receive and which instructions they follow. A vendor writing itself into that trust chain without an explicit opt-in touches the core promise that agents will act on the user's behalf — not on a vendor's behalf.
The HN headline's reference to sharing "all API data" reflects the fear that such hooks could channel API keys, traffic, and project details toward an external service; the GitHub issue itself focuses on the routing and consent mechanics, which the reporter documented with logs and configuration files. Critics in the discussion argued the pattern — a desktop app installing companion plugins into other tools on first launch — sets a dangerous precedent for how AI-era software acquisitions of "mindshare" might work.
As of this writing, the issue remains open with more than twenty comments, and Postman had not published a public response addressing the auto-installation behavior. The company has not been accused of transmitting data without permission in the issue itself; the complaint centers on silent installation and self-approval of hooks.
A Test Case for AI Distribution Norms
The episode arrives amid a broader struggle over norms in the agent ecosystem. Tool vendors now have a new frontier to compete on: not just being installed, but being loaded into every AI-assisted workflow a developer runs. Postman's situation is a test of where the line sits between convenient integration and hostile expansion.
For developers, the practical takeaway is concrete: it is worth auditing agent configuration files, hook registrations, and installed plugins after updating desktop tools — and treating any unrequested change to an AI agent's instructions as a security event. For the tool vendors racing to become the default layer in AI-assisted development, the message from nearly 800 Hacker News upvotes is equally clear: silent self-installation is the fastest way to convert a trusted brand into a cautionary tale.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
