Vendors quietly grab your data, builders push back
Postman silently auto-installs AI plugins and tries to share all API data (50354960). That is the kind of tool that holds auth tokens, internal endpoints and staging payloads. In a separate thread, a Tell HN (50363461) points out that Gemini trains on chat history even for paying subscribers on personal accounts.
The pattern here: AI features are being bolted onto trusted developer and consumer tools as default-on, with data flowing out by default. Paying does not buy you out of it. Ask-for-forgiveness is the rollout strategy, and it is hitting exactly the products developers had stopped thinking about.
The counterpoint is that these are two vendors, and both stories lean on how default settings are described. But the reaction is the signal. Developers now assume any tool with an AI roadmap is a possible exfiltration path.
So what?
If you sell to developers, opt-in AI and a plain-language data policy are now a selling point, not a footnote. If you buy tools, audit what your API clients, editors and plugins phone home to before the next update does it for you.