AI News · Edition 86 ·
The AI You Didn't Order Is Already Inside Your Software
Reports on developer tool Postman and on Google's condition for schools ask the same question: who decides when AI enters your organisation?
The one that matters
Postman, a popular developer tool, is accused of quietly adding AI plugins and trying to share API data
What happened
A report that drew heavy attention on Hacker News, the forum where many software engineers trade notes, claims that Postman silently auto-installs AI plugins and attempts to share all API data. Postman is a widely used tool that developers rely on to test how software systems talk to each other. An API is one of those connections: the line between your fee portal and your payment gateway, or between your clinic's appointment system and the lab.
Keep the limits in view. This rests on a single source. We have not verified it ourselves, and we cannot yet tell you which versions were affected, how many customers saw it, whether any data actually left anyone's systems, or what Postman says in response. The word attempts matters, because an attempt is not a confirmed leak.
What it means for your business
You have probably never opened Postman, but your developer or software supplier may use it every day. Tools like this can hold saved test requests, sample responses and the passwords or keys that unlock live systems. So if the claim holds, and if real data sits in the tool, a 600-student school whose fee portal was built by a local agency could be affected without anyone at the school installing anything. The same goes for a 30-bed clinic with a custom appointment system, or a workshop with 40 staff whose order system feeds its accounting software. A shop running only off-the-shelf billing software has less to check, and one email to the supplier covers it.
The wider point holds whether or not this report stands up. AI features can now arrive through ordinary software updates, and each one can open a new path for your data. Your responsibility does not move to the supplier when that happens. If a tool your contractor chose mishandles patient or student records, patients and parents will come to you first. India's Digital Personal Data Protection Act, Canada's PIPEDA and provincial health-privacy rules generally expect you to answer for how your suppliers handle personal data.
What it does not mean
- It does not mean your data has leaked. Anyone telling you so today is ahead of the evidence.
- It does not mean you should ban AI tools or order developers off Postman overnight. A rushed switch can break working systems and cost more than the risk it removes.
- It does not mean you need a new security product. Expect sellers to use stories like this to pitch expensive AI-governance packages. A 40-person workshop needs a few direct questions first, not another annual subscription.
- It is not only a developers' argument either. Those who wave it away are missing the point: what a tool does with your data without asking is a management question.
What to do this month
- Send one email this week. Ask your developer, agency or software supplier: do you use Postman on our systems, has it added any AI plugins, and are real customer records or live passwords stored in it?
- If live passwords or keys are in there, have them changed. For a small setup with a payment gateway, an SMS provider and a database, budget two or three hours of developer time. That is very roughly ₹3,000–₹8,000 from an Indian agency or C$300–C$600 in Canada; treat these as ballpark figures, not quotes.
- Add one line to supplier contracts. AI features that touch our data stay off until we agree in writing. It costs nothing to ask, and the supplier's reaction will tell you a lot.
- Keep a one-page list. Note which tools hold personal data, who chose them and whether AI features are switched on. Thirty minutes with your office manager is enough for a first version.
- Watch for Postman's response. If it disputes the claim or clarifies who is affected, adjust. Do not spend more until the facts are clearer.
Also worth knowing
How this briefing is put together
Every morning we read the day’s AI announcements and reporting from the companies themselves and from the technology press, then pick the handful that actually change something for a working business. The analysis is ours and it is written for owners and managers, not engineers. Every story links to its original source — read them, and disagree with us where we’ve got it wrong.