A developer has filed a report on Postman's public GitHub issue tracker claiming that the popular API testing app silently auto-installed AI plugins on macOS and then attempted to share API data. The issue, posted in the postmanlabs/postman-app-support repository, describes opening Postman on a Mac and being met with unexpected behaviour from the app.
The claim matters because Postman is used by millions of developers to store API keys, tokens and request collections. If an app installs extensions without clear consent or tries to transmit API data, that raises immediate questions about consent, privacy and how much access developer tools should have by default.
What the GitHub report claims about Postman
According to the issue text, opening Postman on a Mac triggered an automatic installation of AI plugins. The same report says the app attempted to share all API data. The description is brief, and the tracker entry itself does not include a full technical breakdown, packet capture or reproduction steps.
Because the claim comes from an issue filed by a user rather than from an official security advisory, it should be treated as an allegation until Postman or independent researchers confirm what happened. The post has nonetheless spread quickly among developers, who rely on Postman daily for work.
Why API data is sensitive
Postman workspaces often hold live API keys, authentication tokens, environment variables and internal endpoint details. That data is valuable: leaked keys can be used to abuse paid services, reach private systems or extract customer information.
If a tool handles API data, users expect clear, explicit consent before anything leaves their machine. Automatic plugin installation is a separate concern, because extensions can add code that runs inside the app and may have access to the same sensitive material.
