Postman Caught Installing AI Plugins Without Developer Consent
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Postman's desktop app (version 12.33.4 on macOS) was reported to have silently installed its plugin into Claude Code and OpenAI Codex, editing the Codex config file, generating its own trust approvals, and linking an unauthenticated remote MCP server, which caused errors in the assistant.