Start free trial

TRUE, BUTHeadline Over Filing

Install logged, data claim unproven

The GitHub report it summarises documents a silent plugin install and says it does not establish data exfiltration.

“Postman silently auto-installs AI plugins and attempts to share all API data.”

Headline on daily.dev (November 2026), summarising GitHub issue #14370

17 receipts6 support2 refute9 context

Issue 644 November 20263 min
A courier ticks his own approval form at someone else's desk.
AI illustration

The GitHub report quotes Postman's log showing the install, and pinned source showing the installer approving its own hook.

The twist

The same report says it does not establish data exfiltration, and its logged connection to Postman's server failed.

0Data transfers the source report claims to establish
1macOS installation documented in the report
12.33.4Postman desktop version in the report

There’s more to this story.

Membership opens the full investigation, the strongest counterargument and what to do with what you’ve learned.

30 days free, then A$89 a year. Payment card required. Cancel before the trial ends to avoid the first charge.

Start free trial →
  1. At sign-up: 30 days free. Payment card required. One introductory trial per customer.
  2. Your trial ends 30 days after you start. Unless you cancel before then in Account → Manage subscription, we charge A$89 for the first year. It renews automatically at A$89/yr until cancelled.
  3. You can ask for a full refund within 14 days after any annual payment, renewals included, with no reason needed, by emailing [email protected]. This voluntary refund does not limit your rights under the Australian Consumer Law.

By starting your trial, you agree to the Terms.

Inferno Tech Pty Ltd t/a BS Killer, ABN 27 647 413 474

Already a member? Sign in

The trick has a name

We call it Headline Over Filing: the document underneath says something else. You'll see it again. Learn to spot it →

Say this in tomorrow's meeting“The Postman auto-install has log evidence. The 'shares all your API data' part doesn't: the report itself says it does not establish exfiltration. One Mac so far, too.”

Receipts

  1. Supports daily.dev: Postman silently auto-installs AI plugins and attempts to share all API data
  2. Refutes github.com: This report establishes unwanted integration and instruction changes; it does not claim to establish data exfiltration.
  3. Supports github.com: Postman's own log explicitly records automatic installation
  4. Context github.com: Postman desktop: 12.33.4. Codex Postman plugin: 1.1.0.
  5. Supports thenewstack.io: show an installation event on October 24 marked auto-existing-upgrade, with results indicating that plugins for both coding agents had been installed.
  6. Supports github.com: The hook tells the agent to route broad API work into Postman
  7. Context github.com: Open an existing Postman desktop installation after not using it for a while.
  8. Supports github.com: The source establishes the approval attempt.
  9. Context github.com: The trust record alone does not prove who created that specific record
  10. Context github.com: Observed sequence (not yet reproduced on a clean Mac):
  11. Context github.com: A Postman executable and its lib directory were present in ~/.local/bin
  12. Context thenewstack.io: The developer, known as “indicava” on GitHub, reported the issue on October 25
  13. Refutes github.com: The remote MCP was enabled without a working authenticated connection
  14. Context thenewstack.io: The report documents one macOS installation, and the behavior has not been independently reproduced across other systems.
  15. Supports thenewstack.io: According to Postman’s own documentation, its installer can automatically approve a session-start hook on the user’s behalf.
  16. Context aiweekly.co: Did any token-bearing traffic reach mcp.postman.com before the reporter's logged auth failure, and if so from which client?
  17. Context learning.postman.com: You can install into every detected agent on your machine with a single command

Open the Receipts Pack → What each source proves, every figure traced, and what would change our verdict.

Checked by the BS Killer desk · ruled 4 Nov 2026 · How we check →

Get tomorrow's check in your inbox.

One AI claim a night, checked against independent sources, receipts attached. Free.

Free email updates. Unsubscribe any time.

This story is a stable, citable object. If you can falsify a verdict, tell us. Corrections are loud here.