Postman's Silent Data Grab Triggers a Developer Exodus
How this was made Verified AI
Every Intellegix briefing is generated from that day's broadcast and run through automated checks before it publishes — with a human paged on any flag. Here is the trail for this edition.
Postman, the API testing tool used by an estimated ten million developers daily, is facing a severe trust crisis after reports emerged that it had been silently auto-installing AI plugins and attempting to route API traffic through external servers. The issue surfaced on the company's own GitHub support repository and drew more than 1,300 upvotes and 447 comments on Hacker News — a reaction that reflects both the scale of the tool's adoption and the gravity of what it allegedly did.
The core problem is not simply a feature rollout gone wrong. API requests routinely carry authentication tokens, internal endpoint structures, staging environment credentials, and proprietary payload schemas — data that engineers have no expectation will leave their machines. The behavior was apparently opt-out rather than opt-in, or in many reports not clearly disclosed as an option at all. Developers began pulling Postman from company-approved software lists entirely.
The fallout accelerated interest in Milkman, a Postman alternative built around a local-first, privacy-respecting architecture with no built-in phone-home mechanism. Its Hacker News thread drew 36 comments, most from people asking about feature parity or reporting they had already switched. Postman, by contrast, has been under investor pressure to build an AI monetization story — a pressure that may explain why the rollout bypassed the kind of consent that its user base would have required.
A parallel thread flagged that Google's Gemini trains on chat history even for paid subscribers on personal accounts, with an opt-out toggle reportedly buried in settings. The pattern across both cases is the same: data treated as a resource to be harvested unless users affirmatively object, rather than something protected unless users affirmatively consent. That architecture, observers noted, is increasingly a legislative target, with the EU's AI Act containing training-data provisions that carry meaningful enforcement teeth.
An essay circulating this week titled 'There Is No Posttraining Data Commons' extended the argument to a civilizational scale: the fine-tuning and reinforcement-learning data that shapes AI model behavior is almost entirely proprietary and siloed inside large labs, with no open shared resource equivalent to Common Crawl for pretraining. Whoever controls posttraining data, the argument runs, controls the personality and values of the models — a consent problem orders of magnitude larger than any single tool's settings menu.