Postman auto-installs AI plugins that attempt to exfiltrate API data
4 November 2026 · filed under da9a5824109f
A GitHub issue filed against Postman’s application support repository describes the API platform as silently auto-installing AI plugins that attempt to share all API data. The issue, titled “Postman silently auto-installs AI plugins and attempts to share all API data,” was logged under the postmanlabs/postman-app-support repository on GitHub.
The report was aggregated by Hacker News, where it appeared as a linked item on November 3, 2026. Beyond the issue’s title, no further detail, including the identity of the filer, the mechanism by which plugins are installed, or the specific data targeted for sharing, has been made available in the material reviewed for this bulletin.
The title itself establishes two claims: that the auto-installation occurs silently, and that the installed plugins attempt to share all API data. No source consulted specifies whether affected users were given any notice or opportunity to decline the installation, nor does any source describe what, if anything, was actually transmitted or to what destination.
No statement from Postman, the plugin developers, or any named individual has been located addressing the issue. No resolution, acknowledgment, or official response is recorded in the material available.
This bulletin will be updated as further particulars, including any statement from Postman or confirmation of the issue’s disposition, become available through verified sources.