UK AI Weekly: Postman’s AI install raises a very British question: consent, mate?

Opening Postman on one Mac allegedly changed the behaviour of two coding agents without the user explicitly asking it to. The resulting GitHub issue, “[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook,” has attracted 1,211 points on Hacker News. That is not proof of a scandal, but it is certainly not a casual Tuesday either.

According to the issue, Postman Desktop 12.33.4 followed an “auto-existing-upgrade” path and installed user-wide integrations for Codex and Claude Code. Postman logs reportedly recorded both installations as successful on 24 October. The report also identifies a separately installed Postman CLI and a remote MCP configuration pointing to mcp.postman.com.

The more consequential detail is the startup instruction. The Codex hook tells the agent to load Postman’s api-engineer skill before handling any “non-trivial API engineering task”, including designing, implementing, mocking, testing, monitoring, documenting or deploying an API. In other words, one notification said “Postman”; the coding agent then heard “make Postman your default workflow” in a rather literal voice.

The report also says the installer attempted to approve Postman’s own hook by writing trust hashes into Codex’s global configuration. The author sensibly stops short of claiming that proves a particular user interaction occurred. Likewise, the MCP connection failed because authentication was required, and the report explicitly does not establish data exfiltration. The sequence has not yet been reproduced on a clean Mac.

So what exactly is known? An unwanted integration and instruction change allegedly occurred, with logs and configuration changes offered as evidence. What is not known is who authorised it, whether it was deliberate product design, what Postman’s response is, or whether any data left the machine. A trust-boundary problem is not automatically a cyberattack. It is still a consent problem.

What this means

For UK developers, the concern is not abstract AI policy. It is a developer opening a familiar API tool and finding that their coding environment has been reorganised around it. Convenient integration can become scope creep when it arrives silently, especially once an agent gains broad instructions and access to workflows outside the application the user actually opened.

UK regulators already have relevant powers, even though there is no AI-specific statute and no single AI regulator. If the integrations collected or transmitted personal data, the ICO could assess the handling under the UK GDPR and the Data (Use and Access) Act 2025. The questions would be familiar: was consent meaningful, was the processing necessary and transparent, and did users retain real control? “We enabled it by default” is not a satisfying answer when the default modifies someone else’s tools.

The AI Security Institute’s work on independent pre-deployment evaluations of frontier models will not settle this particular case. This is also not mainly about making a model more capable. It is about product boundaries, permission and whether an AI tool understands the difference between helping and taking the wheel.

Postman should explain the auto-existing-upgrade decision, document exactly what it installs and changes, and make every such change visible and reversible. The report may not prove malicious intent, but it has demonstrated how quickly “helpful onboarding” can look like an uninvited housemate rearranging the furniture.

The takeaway is simple: an AI-powered tool that changes other tools must earn the right to do so through explicit consent, and “we thought you might like it” is not consent.

Source: Postman silently auto-installs AI plugins and attempts to share all API data — 1211 points on Hacker News