iCreatAI News
Back to main site
Skip to content
Only Industry#MCP / tool use
Nov 14Sat
  1. Cloudflare Blog66

    Adapting to AI penetration testing orchestrators: The Modern Security Model

    Cloudflare reports that since the original ARTEX agentic pentesting framework was taken down on October 8, over 12,000 repositories and 50+ framework families have emerged, with daily requests for AI pentesting tools up 30x since October 1 and ARTEX and its forks making up over 60% of known orchestrators as of November 12. Cloudforce One observed incidents where stolen static CI/CD tokens were chained with these frameworks, including ARTEX creating artex-* Worker scripts and generating over 69 requests per minute and 400 database dump requests in an hour. The post recommends a six-pillar "Modern Security Model" covering WAF and traffic control, anomaly detection, Bot Defense, Identity-Gated Access and micro-segmentation, schema validation and mTLS, and threat intelligence.

    Why it matters: Offers a data-backed view of how quickly autonomous LLM pentesting frameworks are proliferating and a concrete defensive framework for security teams.

Nov 10Tue
  1. Hacker News AI60

    American Express is cutting 5% of its workforce to 'prepare for AI'

    American Express is eliminating 5% of its global workforce and taking a $336 million restructuring charge, CEO Stephen Squeri said on the company's third-quarter earnings call. CFO Christophe Le Caillec told CNBC the restructuring was meant to make Amex "leaner, more agile, and also to prepare for AI," saying the company wants to reduce layers so it can automate processes in coming quarters and years. Amex reported adjusted earnings per share of $4.68, beating the $4.48 average estimate, and raised its full-year earnings guidance to $18.30 to $18.60 per share, while revenue rose 9% to $20.06 billion, slightly below the $20.12 billion forecast.

Nov 4Wed
  1. Hacker News AI60

    Postman silently auto-installs AI plugins and attempts to share all API data

    A GitHub issue reports that opening Postman desktop 12.33.4 on macOS triggered automatic installation of Postman plugins into Codex and Claude Code, a user-wide startup hook instructing agents to load Postman skills for broad API engineering tasks, and a remote MCP connection to mcp.postman.com/mcp that failed with "Auth required." The report cites Postman's own log recording an "auto-existing-upgrade" install and installer source code that calls config/batchWrite to set a trusted_hash for its own hook, which the author frames as a consent and trust-boundary problem while stating it does not claim data exfiltration.

Oct 31Sat
  1. The Decoder58

    Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft

    A tampered version of the Claude Code extension for Cursor was available in the Cursor VS Code extension marketplace on Thursday for about eleven hours, affecting up to 5,000 users, according to Cursor. The extension tried to harvest data such as hostname, username, operating system and public IP address, and attempted to set up remote access for the attacker, which Cursor says likely wouldn't have worked on most machines since it requires admin privileges. Cursor pulled the extension and took the entire marketplace offline, then reinstated it after working with providers to neutralize the malware and confirming no further risk, saying no other extensions were affected.

Oct 28Wed
  1. Pydantic AI Articles22

    I received the AAIF Outstanding Technical Contribution Award

    The author received the Agentic AI Foundation's Outstanding Technical Contribution Award at AGNTCon + MCPCon North America for their work as one of the two maintainers of the MCP Python SDK, including the v2 release shipped alongside the 2026-07-28 MCP specification revision with a new MCPServer API and multi-round-trip requests. They also sponsored SEP-1288 for the WebSocket transport and thanked colleague Laís Carvalho for the nomination and Pydantic for funding their open source work. The post notes that the Logfire MCP server runs on the same Python SDK and is where this work lands first.

Oct 23Fri
  1. TechCrunch · AI62

    While Amazon blocks AI agents, Walmart rolls out the welcome mat

    Walmart announced an Agent Gateway, an MCP server that lets approved AI agents search its online inventory and make purchases for users, along with Agent Profiles rolling out next month that let customers authorize each agent, track its purchases separately, and set per-transaction approval or spending limits. The retailer also introduced terms for AI agents, stating its returns process applies even when an agent doesn't act as intended, and that agents cannot access payment information or act beyond the shopper's intent. The move follows Amazon's blocking of AI agents from making purchases on shoppers' behalf.