Postman

Postman is a widely used API development platform that engineers rely on to build, test, and share the interfaces that connect software systems, including many AI tools and model services. Because it often stores live API keys, access tokens, and collection data in shared workspaces, a security lapse in Postman or in how a team uses it can expose credentials that unlock internal systems. For compliance and risk leaders, Postman is a practical point to review when setting rules for where developers keep secrets and how AI-related integrations are tested and shared.

1 item

Corporate PolicyGlobal2026-11-04

Postman Auto-Installed AI Plugins and Tried to Self-Approve Its Own Trust Hooks

Postman desktop version 12.33.4 silently installed plugins into OpenAI Codex and Anthropic Claude Code when users simply opened the application. The installer injected session-start instructions routing API traffic through Postman. It also opened a remote connection to mcp.postman.com and attempted to approve its own elevated trust permissions in Codex without user consent. The incident exposes a structural gap in how enterprises govern the update pipelines of tools that have direct access to AI coding agents.

supply chain risk MCP servers OpenAI Codex Claude Code Postman agentic AI permission escalation developer tools