Postman silently auto-installs AI plugins, injects startup hooks into other apps
Developer discovers Postman 12.33.4 automatically installing plugins and system-wide instruction hooks without consent, routing unrelated AI tools through Postman by default.
What to know
- Postman 12.33.4 automatically installed plugins, remote MCP connections, and startup instruction hooks into Claude's Codex and other tools without explicit user consent—each integration required no per-application opt-in.
- The installed hooks inject 'load the postman:api-engineer skill' into all API engineering tasks system-wide, making Postman the default workflow for unrelated applications.
- The automatic approval mechanism uses approvePostmanHook(system) to mark Postman's hooks as trusted immediately after installation, bypassing user confirmation.
- Developers report decades-long pattern of Postman shifting from simple open-source-like tool to venture-backed platform with mandatory logins, data collection, subscriptions, and AI features; this incident accelerated mass migration to alternatives (Bruno, Kreya, Yaak, curl).
The dispute Whether Postman's $5B+ valuation is justified given that most developer users have left—defenders note B2B/enterprise lock-in and non-technical user bases sustain revenue, while critics see it as a bubble built on venture-funded user exploitation. · positions read across 52 posts and comments
This is a severe trust violation that demands immediate tool replacement and organizational decertification.
-
“This is very bad. I've alerted my team and we'll be deprecating its use immediately.”
simpaticoder · Hacker News ↗
Postman's decline reflects broader venture-capital corruption of simple developer tools; this is inevitable when growth and valuation become the goal.
-
“It's a shame what happened to Postman. It started as an excellent little developer tool for testing APIs. Then for some reason they raised over $400M in funding and hired 1,500+ employees.”
pants2 · Hacker News ↗
Developers should switch to lightweight, offline-first, git-friendly alternatives (Bruno, Kreya, Yaak, curl) that respect privacy and don't require logins.
-
“I have been building Kreya for over 6 years now as a Postman alternative. It's offline-first and privacy focused with a storage format made for git.”
CommonGuy · Hacker News ↗
Postman still dominates in business/non-technical contexts (testers, business analysts, procurement contracts), even though developers have abandoned it.
-
“I do know business analysts, testers, non-technical people asking me for postman collections. Postman became de-facto standard for businesses.”
ozim · Hacker News ↗
sidgarimella Developer / reporterPostman Labs Software vendor
How it unfolded 3 developments, newest first · click a bar or a number to jump articlespostscomments
-
3
Commenters highlight Postman's historical pattern of undocumented behavior changes
Developers recount that Postman has a long history of surprising users with undocumented caching, unexpected behavior, and integration features that were never explicitly requested.
“I found that Postman was caching what should have been independent requests. Easily blamed on Chrome at the time, but it was an undocumented and unexpected behavior by Postman.”
— eddieroger -
In the Github issue filed, the context[1] for session start was authored by a Postman engineer [2] whose Github profile[3] page tagline is "I Solemnly Swear That I Am Up to No Good."Yeah, I am sure that engineer was trying to be witty and clever, but now if Postman's ever got sued in court, the joke's on them.I swear I am not making this SH*T…
2 more of the top 3 · 39 posts in this stretch
-
Postman 桌面端现会自动在设备 agent 应用安装 skills 及 hook，引起争议。 - 还包括配置远端 MCP 服务以及安装 Postman CLI 等。 gh:postmanlabs/postman-app-support#14370 seealso: HackerNews:50354960 #Postman #LLM Telegram 原文
-
It's so hard to see this happen. I worked for postman for 4 years, and it was a great place to work for a long time. I've also seen how the industry has changed.As agents start to write all the code, API platforms need to adapt to the new user. That means a complete rethink about how to approach API development.It's why I'm building Sannr, an API…
-
-
2
Commenters describe pattern of Postman's business model shift toward aggressive data collection
Multiple developers voice frustration that Postman transformed from a simple open-source-like tool into a venture-backed platform requiring logins, collecting API request data (including secrets in template variables), forcing subscriptions, and now injecting AI features. One commenter noted Postman logs all API requests including query parameters containing secrets, making it non-HIPAA-compliant.
“Postman logs detailed information on every single API request you make through its tool, including query parameters. If you disable outgoing network traffic to this logging endpoint, the entire app will stop working properly.”
— primitivesuave -
> for some reason they raised over $400M in funding and hired 1,500+ employeesYou know the reason. A bunch of people were able to take home a lot of money because of that growth and now have the option to FIRE themselves whenever they want to shake off the stress.That's the founder mentality that Y Combinator exists to leverage or encourage and…
2 more of the top 3 · 11 posts in this stretch
-
> Instead they now have to justify their valuation by forcing logins, collecting data, monthly subscriptions, AI features, etc.All those people who gave them millions in funding are expecting to make a return on that investment and that means prioritizing turning it into something that will make money by selling out users. The valuation is just a…
-
I have been building Kreya [1] for over 6 years now as a Postman alternative. It's offline-first and privacy focused with a storage format made for git.In all our years, Kreya "just worked" for our users without any drama or unwanted changes, unlike most of our competitors...[1]
-
-
1
Developers report mass migration away from Postman to alternatives
Comments across Hacker News document widespread developer abandonment of Postman over privacy concerns, feature bloat, login requirements, and AI additions. Multiple commenters mention switching to Bruno, Kreya, Yaak, RESTer, and curl; one healthcare workplace reports Postman was decertified by their cyber team and users switched overnight.
“Working in healthcare, and Postman got decertified by our Cyber team for this. We all switched to Bruno overnight.”
— bottombutton -
It's a shame what happened to Postman. It started as an excellent little developer tool for testing APIs. Then for some reason they raised over $400M in funding and hired 1,500+ employees, for what should have been a tiny OSS/passion project like curl or little snitch. Instead they now have to justify their valuation by forcing logins, collecting…
1 more of the top 2 · 2 posts in this stretch
-
We went to bruno years ago and has been good. Nice to be able to store the request definitions in git. But to be honest, don't really need any of these tools anymore.
-
-
background
Report published on GitHub and Hacker News with technical evidence — sidgarimella posted detailed findings to Postman's GitHub support issue tracker and Hacker News, including specific file paths, timestamps from Postman's own logs (2026-10-24T09:34:14.418Z), source code links pinned to commit 6c8e452e0f4237f4bcc0901cb1ac442dec707e49, and the exact text of injected startup instructions. The post reached 1,037 points and 345 comments on Hacker News within hours.
-
background
Developer discovers unwanted cross-application integrations and broad startup instructions — A developer investigation found a user-wide Postman plugin, startup instruction hook, remote MCP connection, and CLI installation. The hooks register a SessionStart command that injects 'load the postman:api-engineer skill' into all API engineering tasks, far broader than any explicit user request.
-
background
Postman installer automatically approves hooks in Claude Codex — Postman version 12.33.4 installs a plugin that registers startup instruction hooks in Claude's Codex environment without explicit user confirmation. The installer invokes approvePostmanHook(system) immediately after plugin installation, marking the Postman hook as trusted.
Also covered reported alongside — the timeline has no entry for these yet
-
first by HN Best, 5d ago · also HN Frontpage
What people are saying 17 voices from 1 site · best of 52 · verbatim
- What is Postman's official response to the automatic hook installation and consent bypass?
- Does Postman actually exfiltrate API data through these injected connections, or only create the infrastructure for it?
- Will healthcare and financial organizations formally audit or decertify Postman for this behavior, creating industry momentum?
- Nov 5
-
My project freezes the postman version to the last one which supports local data, 10.27.x or something. I honestly can't fathom what extra feature can a newer version have that is critically missing from this old one. It feels like a solved problem to me. I know that tools change all the time, but this version seems to do whatever a postman like…
- Nov 4
-
I was about to ask why on earth an HTTP client needs 1500 employees and a 5B valuation, but then I realized that perhaps it is just envy speaking.Im simply envious that I dont own an AI-native cloud-first enterprise-grade zero-trust secure-by-design API lifecycle management ecosystem powered by agentic AI workflows autonomous coding agents pre…
-
Relying on heavily managed, LLM-driven developer platforms introduces severe data exfiltration risks. These complex environments mostly preferred by newer generations of programmers represent critical supply chain exploitation risks that simply never existed in traditional local setups. The consequences are incidents like recent Binance hack.
-
just last week i was looking for a tui version of postman and found https://github.com/darrenburns/postingi've been using the beta since and am very happy. api checks are just yaml and can get stored in git to version and share and tui is nice and easy to drive via the keyboard
-
Postman used to be a simple tool to make http requests.Now it is some kind of incomprehensible thing that requires me to log in and create a 'collection' or whatever it was when I just wanted to make a simple call to some api to see what it does.Like.. wtf. Why did they need to turn it into some monstrosity?
-
Yep I’m finally switching off of postman today. I’ve wanted to for a while, but my team at work uses it, and all of our shared stuff is in there.I’ve been thinking of replacing postman with a clojure project, where you just send stuff to the REPL to call it. You could even set up a little dependency map, so your calls would have built-in behavior…
- Nov 3
-
If you're a backend dev writing an API you should be writing automated tests. Clicking around in a GUI app is not the correct way to do things.If you're exploring someone else's API there are lots of other clients you can use. Resonance seems pretty solid to me. Don't get what's the point of all the extra faff in Postman.If you want to get real…
-
Yes, this is very bad. I've alerted my team and we'll be deprecating its use immediately. Hopefully procurement can get refunds on the licenses we purchased not that long ago. Something tells me Postman is going to regret violating people's trust - the moat isn't so large that people must endure unethical, if not illegal, behavior like this.
-
> I still don't know how they're valued at $5B+Because, current valuations are completely detached from any operational or market realities that affect a company. The metric has become the goal, and the metric is controlled by nontechnical people that have no intuitive understanding of how technical products are used. Even worse, they’ve all gone…
-
I use RESTer, a Firefox extension, to test APIs: https://addons.mozilla.org/en-US/firefox/addon/rester/It's an in-browser equivalent of Postman.I much prefer the approach of being able to use the browser for things like this. It feels much more lightweight than installing a piece of desktop software.
-
We're using Postman at work (I think we have a subscription for 10 or 20 users), mostly when doing REST development and to share the API calls between people. Though I rarely have to use it so each time I'm so confused of between the collections, environment, vaults, variables...Also if you have an alternative that's easier to use, I'm interested
-
Many, many years ago, I used Postman for the first time, way back when it was a Chrome plugin. As an iOS dev, it was amazing to be able to validate the requests I needed to make outside the context of my code to validate things worked. Until, one day, I wasn't seeing something iterate in the responses I was getting as I expected to. Many cmd+R…
-
>It's a shame what happened to Postman. It started as an excellent little developer tool for testing APIs. Then for some reason they raised over $400M in funding and hired 1,500+ employees, for what should have been a tiny OSS/passion project like curl or little snitch. Instead they now have to justify their valuation by forcing logins, collecting…
-
Postman was my curl with a gui. Used it everywhere, recommended it everywhere. But one day out of the blue it asks me to login, and it all went downhill from there. Imagine you had to login to use curl?Anyway, I'm sure somewhere in some terms and conditions I agreed to, it says "we own the glass".
-
When they started uploading things to the server and requiring you to have an account to access the things that they STOLE from your machine without authorization in first place, I uninstall it...What can go wrong by uploading your things, if you had any passwords or users there that "pinky promise" will not be uploaded, then running AI and maybe…
-
I used to use Postman daily almost ten years ago. Then as my last hurrah before retirement, I took an embedded job that didn't involve me beating on a web API, so I didn't use Postman anymore.So imagine that I hear about this "Postman" product that involves subscriptions, and AI, and "valued at $X billion" and all this crap, and you can see how I…
-
> I still don't know how they're valued at $5B+ when I don't know a single developer who actually uses it anymoreB2B maybe? Usually these businesses thrive solely on flirting with the CTO and getting them to sign a lucrative contract and then mandate internal usage. I'm speaking from experience.