What happened?

According to an issue filed in Postman's GitHub support repository, the app automatically installs AI plugins without asking the user and attempts to share all API data. The thread reached 727 points on Hacker News, placing it among the day's top stories.

Why it matters

Postman is widely used for API development and testing. Teams keep API keys, access tokens and customer data there. An unsolicited plugin installation and data-sharing attempt raises the risk that this sensitive information could go somewhere unexpected.

Details are limited

The source provides only the issue title; it is unclear which plugins were installed, what data was to be shared and which versions are affected. Postman has not issued a statement on the matter.

What users can do

  • Review installed plugins and AI feature settings in Postman.
  • Remove sensitive API keys and customer data from shared workspaces.
  • Notify your internal security team and stay cautious until an official statement arrives.