Security/shipped/2026-10-24

Postman desktop app reportedly installed AI plugins and accessed user data without consent

Multiple outlets report that the Postman desktop application automatically installed AI plugins, specifically for Claude Code and Codex, without explicit user consent. This action reportedly allowed the application to access user API data. The incident has raised concerns regarding user privacy and control over software installations.

3 articles from 3 outlets covered this story. Their coverage differs on 1 point. The underlying claim is sourced from a shipped.

What do all outlets agree on?

3 outlets covered “Postman desktop app reportedly installed AI plugins and accessed user data without consent”. All of them report the following:

  • Postman desktop application
  • Installed AI plugins
  • Without explicit user consent
  • Involved Claude Code and Codex

Did outlets disagree about this?

Yes. Coverage of “Postman desktop app reportedly installed AI plugins and accessed user data without consent” differs on 1 point. Each account below is how a different outlet described the same event:

The Postman application attempted to share all user API data.

Hacker News

Which outlets covered this?

All 3 articles found on this story, grouped by the stance of the piece. Every link goes to the original publisher.

What related stories are there?

Which companies does this involve?

Get the week in AI in one email

What happened, which outlets reported it, and where their coverage differed. One issue a week.

The first issue hasn’t gone out yet. Subscribe and it’s the one you’ll get.

We’ll send the digest and nothing else. One-click unsubscribe. Privacy.