EU AI Watch: Postman’s AI sidekick came uninvited

Opening Postman was enough to install AI plugins for Codex and Claude Code, add a command-line tool, and register startup instructions that could redirect API work. No grand gesture, no visible opt-in — just software quietly making itself at home. That is the latest example of why Europe’s new AI rules are about to get less theoretical.

According to the GitHub issue, Postman’s own log recorded an “auto-existing-upgrade” that installed both the Claude Code and Codex plugins on a Mac. The Codex configuration was then changed to enable Postman, while a startup hook instructed the agent to load Postman’s API-engineering skill before responding to any non-trivial API task. The installer also attempted to approve its own hook by writing trust hashes into the user’s configuration.

The remote MCP connection to mcp.postman.com/mcp was enabled, although authentication failed in the reported run. The issue does not establish that data was exfiltrated, and the sequence has not yet been reproduced on a clean Mac. Those are important caveats. They do not make the documented behaviour particularly reassuring, though. A trust boundary that approves itself is not quite the reassuring kind.

For Europe, the timing is awkward. The EU AI Act became applicable on 2 August 2026, and enforcement powers for the AI Office and national authorities are now live. Its Article 50 transparency obligations also apply from that date, while many high-risk-system duties still arrive later. If an integration changes how an AI agent behaves, its legal classification may depend on what the integration does and who supplies or deploys it. There is no automatic AI Act violation merely because software installs a plugin.

Still, the Act’s governance and AI-literacy requirements sharpen the question European companies should be asking: what exactly are we allowing to influence our agents, and do our users understand it? An instruction to route broad API work into one vendor’s workflow deserves more scrutiny than a standard update, especially when it can affect development, testing and deployment activity.

GDPR remains relevant too, but it should not be stretched into a universal consent law. If an authenticated MCP connection transmits personal data, organisations still need a lawful basis, appropriate processor arrangements, data minimisation and clear security controls. Here, authentication failed and the report makes no claim of data theft. Better to design for the authenticated case than comfort ourselves with the failed one.

What this means

European AI companies and development teams should treat third-party agent integrations like privileged software, not onboarding conveniences. Explicit consent, narrowly scoped permissions, visible installation logs, inspectable instructions and no self-approval should be baseline requirements. Remote connections also need clear disclosure and documented data flows.

The broader issue is accountability. Once an agent acts on hidden startup instructions, responsibility becomes pleasantly elastic: the desktop app installed it, the plugin requested it, the agent followed it and the user simply opened Postman. Europe’s regulatory moment is a good opportunity to insist that responsibility stays human-sized.

The takeaway is simple: AI tools that quietly alter other AI tools have crossed from convenience into governance, and Europe’s newly enforceable rules make “we did not notice” a much weaker answer.

Source: Postman silently auto-installs AI plugins and attempts to share all API data — 1211 points on Hacker News