32.9% of respondents to a Salt Security survey said they had found an unauthorised, shadow or misconfigured MCP server in their organisation in the past 12 months.
The figure comes from Salt's State of Agentic AI and API Security 2H 2026, published on 13 October. Salt surveyed more than 380 security, technology, architecture, application security, API platform and DevOps professionals, 35% of them in technology and 16.7% in financial services and insurance. Salt sells agentic and API security, and its release presents the findings as the case for that discipline.
What the shadow MCP figure counts
MCP servers are the connectors that give an AI agent tools and data, from a ticketing system to a company's APIs. Salt's figure puts three different problems in one answer. An unauthorised server is one nobody approved, a shadow server is one nobody knew about, and a misconfigured one may have been approved and set up wrongly. Salt's release and its report page don't say how the 32.9% divides between them.
It counts confirmed finds only. A wider 54.3% said they had found or suspected one. Both figures are what respondents reported about their own organisations, not the result of an audit, so they describe what security teams have noticed rather than what is there.
Salt also reports a measurement of its own that points the same way. Salt Labs detected MCP-related infrastructure in 21.6% of its customers' environments in August 2026, up from 16.7% in January. It covers a different population, Salt's own customers, and it measures how much MCP is present without saying whether any of it was approved.
What Postman's desktop app did
On 25 October a developer opened an issue on Postman's public GitHub tracker. They reported that after opening Postman's desktop app, version 12.33.4 on macOS, Postman's own log recorded an automatic install, marked "auto-existing-upgrade", that put Postman plugins into both Claude Code and OpenAI's Codex. In Codex's user-wide settings they found a new plugin marketplace, the Postman plugin enabled, a session-start hook marked as trusted, and a connection to Postman's remote MCP server. The MCP server kept failing to authenticate, which is part of how they noticed.
The developer said the sequence had not been reproduced on a clean Mac, and that the report shows unwanted changes to their agents, not data theft. The New Stack reported it on 3 November and said Postman had not responded by publication. The New Stack's owner, Insight Partners, is an investor in Postman.
Postman's own documentation confirms one part independently. When its installer sets up the Codex plugin, it approves the hook on the user's behalf, whereas installing through Codex itself leaves that approval to the user. On 5 November a Postman staff member wrote in the issue that the change had been meant to simplify setup, that the company would redesign it "with the right level of control", and that it was reverting the change in the meantime.
A week earlier, on 28 October, GitHub made enterprise plugin controls generally available in VS Code, Copilot CLI and the Copilot app. Administrators can approve marketplaces and require or block specific plugins, and those managed settings override repository and personal choices. GitHub's documentation says a plugin can bundle MCP server configurations alongside skills and hooks.
Why plugins make MCP servers hard to see
An automatic plugin install can add an MCP configuration without the developer choosing that connection.
The report illustrates a possible route to shadow MCP infrastructure; it does not establish how any of Salt’s respondents found theirs. In the developer's account, the MCP connection arrived inside a plugin, installed by a different application, into coding agents the developer called unrelated. An automatic plugin install can add an MCP configuration without the developer choosing that connection.
GitHub's controls are built for that gap, though they wouldn't have closed it here. They govern plugins in GitHub's own tools, and they need GitHub Enterprise Cloud with Copilot Business or Enterprise. Postman's installer wrote to Claude Code and Codex, which GitHub's settings don't reach. GitHub's release describes what the controls do, with no figures yet on how they are used.
Auditing the MCP servers on your developers' machines
Pick a few developer laptops and list every MCP server configured in each coding agent, user-wide as well as per project. For each one, find who approved it, and check which arrived inside a plugin nobody chose.
Sources
- Salt Security, "State of Agentic AI and API Security 2H 2026", 13 October 2026 — https://salt.security/press-releases/state-of-agentic-ai-and-api-security-2h-2026
- Salt Security, "AI and API Security Trends 2026 (H2)", October 2026 — https://salt.security/api-security-trends
- indicava, "[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook", postmanlabs/postman-app-support issue 14370, 25 October 2026 — https://github.com/postmanlabs/postman-app-support/issues/14370
- The New Stack, "A developer opened Postman. Then two AI coding agents changed without their permission.", Amanda Caswell, 3 November 2026 — https://thenewstack.io/postman-plugin-coding-agents/
- Postman, "Install the Postman plugin into detected agents", accessed 6 November 2026 — https://learning.postman.com/docs/postman-plugin/install/detected-agents/
- GitHub, "Repository plugin defaults and enterprise plugin controls generally available", 28 October 2026 — https://github.blog/changelog/2026-10-28-repository-plugin-defaults-and-enterprise-plugin-controls-generally-available
- GitHub, "Plugins for GitHub Copilot", accessed 6 November 2026 — https://docs.github.com/copilot/concepts/customizations/plugins