Postman AI Plugin Hijacking Sparks Developer Outcry

The article describes how Postman's desktop client silently modified local developer environments—installing background extensions, registering plugin repositories, and injecting persistent session startup hooks into OpenAI Codex and Claude Code—to route API development through Postman tools without explicit user consent; the vendor defended the change as onboarding convenience and pledged future authorization prompts while advising manual removal steps in the interim.