Postman Caught Installing AI Plugins Without Developer Consent
Postman 12.33.4 on macOS was found automatically installing its extension into Claude Code and OpenAI Codex without user consent, modifying configuration files and self-approving its autorun script. The unauthorised setup also pointed agents at a remote MCP server, causing authentication errors. The incident matters because developer tools that silently rewrite AI agent configurations undermine trust and corporate security controls.
SOURCES
- Hacker News (AI)2026-11-04 16:38