Postman silently auto-installs AI plugins and attempts to share all API data
Summary
A GitHub issue documents Postman Desktop auto-installing Codex/Claude plugins, starting hooks, and remote MCP connections that route API work through Postman. The report frames this as a severe consent and security boundary incident, calling for opt-in controls, rollback paths, and removal of installer-side hook approvals. It provides detailed evidence and asks maintainer triage at severe priority.