“The Hidden Cost of Agentic Connectivity”

Cloud Village is an open space to meet folks interested in offensive and defensive aspects of cloud security.

Cloud village is an open space to meet folks interested in offensive and defensive aspects of cloud security. The village is to various activities like talks, workshops, CTFs and discussions targeted around cloud services.

If you are a professional who is looking to gain knowledge on securely maintaining the cloud stack and loves to be around like-minded security folks who the similar zeal towards the community, Cloud Village is the perfect place for you.

Cloud Village will be in-person at DEF CON 34, Las Vegas Convention Center from 7th August to 9th August 2026 Hope to see you all there!

Kick off to the DEF CON 34 journey.

💡 Talk by Seth Art New AWS IAM Attack Paths and the Framework to Exploit Them

In cloud environments, the path from low-privilege foothold to full account takeover often runs through IAM privilege escalation. This talk introduces over a dozen newly discovered escalation paths spanning services that have never appeared in public research: AWS Batch, Amazon Braket, Amazon Managed Apache Flink, Amazon GameLift, Health Omics, and more.

We'll walk through exploiting the most interesting paths in depth, including cross-account variants and attacks that require delivering malicious code payloads to trigger escalation. Then we'll introduce Pathrunner, a new open-source Metasploit-style framework built specifically for IAM privilege escalation, and show how it makes chaining these complex, multi-hop attacks practical during a real engagement.

Seth Art is a Security Researcher & Advocate at Datadog. Prior to joining Datadog, Seth created and led the Cloud Penetration Testing practice at Bishop Fox. He is the author of pathfinding.cloud, an AWS IAM privilege escalation library, and has published many open source tools including Pathfinding-labs, IAMVulnerable, BadPods, and CloudFoxable, and is the co-creator of the popular cloud penetration testing tool, CloudFox.

💡 Talk by Elzer Pineda & Jose Rivas Tokens and PRT: Advanced Attacks and Persistence in Microsoft Entra ID

Speakers: Elzer Pineda & Jose Rivas

Is MFA and Conditional Access a real security guarantee? In this technical session, we will demonstrate how endpoint compromise allows an attacker to bypass traditional identity barriers in the cloud. The talk focuses on exploiting vulnerabilities in Microsoft Entra ID, breaking down an advanced attack chain:

• Device Code Flow: Abuse of authentication flows for initial access (Demo with Entraith).

• PowerShell Hijacking: Process interception to obtain session tokens (GrabTokenAzureAD).

• Sliver BOF Extraction: Use of Beacon Object Files (BOF) for stealthy exfiltration of tokens and the Primary Refresh Token (PRT) from memory, evading anti-malware defenses.

• MFA Bypass and Intune: Custom tools were developed to extract local PRTs, bypass Intune device management controls, and circumvent MFA. The entire process was automated through the open-source tool enabling attacks via device code flow, token renewal, email and app inspection, token exfiltration, and persistence generation.

Regional Pentester and Cybersecurity Consultant, Elzer Pineda is an active member of the Red Team executing strategic consulting projects and advanced penetration testing engagements. His career has been focused on Threat Research for private and government organizations across the region. He is a Dojo Community Ambassador and Professor at the Universidad Tecnológica de Panamá (UTP). His experience has taken him to technical research at Ekoparty, BSides Latam Peru, BSides Panamá, DOJOConf, PwnedCR, and OWASP Latam. Offensive security certifications: OSWE, OSEP, OSCP, OSWP, CRTP, CRTO, and CRTL.

Jose Rivas is an Offensive Security Researcher and Red Team Operator at A-LIGN, specializing in adversarial simulations, Active Directory attack paths, and physical security assessments. Co-founder of Zero Trust Offsec, an offensive security research group focused on vulnerability exploitation, emerging attack techniques, and responsible disclosure, and Founder of DCG Panama, Panama's first official DEF CON chapter, where he leads a community dedicated to red team operations, and adversarial tradecraft. A recognized voice in the Panamanian security community, Jose has spoken at BSides Colombia, BSides Panama, OWASP Panama, and DOJOConf. With certifications including CRTO, eWPT, eCPPT, and CompTIA PenTest+, he brings a threat-actor mindset and a strong commitment to advancing offensive security knowledge across the region.

💡 Talk by Saksham Agrawal From Pipeline to Cloud Control

Speaker: Saksham Agrawal

Azure DevOps service connections are a core part of modern pipelines, allowing teams to interact with Azure and other external systems seamlessly. While they make deployments faster and easier, they also introduce an attack surface that is often overlooked in real-world environments.

In this research, we explore new attack paths showing how even limited access within Azure DevOps pipelines can be leveraged to escalate privileges and compromise cloud environments. By taking advantage of over-scoped service connections and certain platform behaviors, an attacker can chain together small gaps to achieve significant impact, including gaining subscription-level access.

These findings were reported to Microsoft and acknowledged through MSRC, highlighting a deeper issue in how DevOps integrations are secured. Rather than being just a configuration problem, this reflects a broader gap that organizations need to understand when designing their cloud security approach.

Saksham Agrawal is a Senior Security Consultant at NotSoSecure, specializing in AWS and Azure security. His work focuses on discovering new attack paths in cloud environments and helping organizations understand real-world risks. He enjoys building tools, exploring cloud internals, and sharing his findings with the security community.

💡 Talk by Pujita Sahni & Geoff Sweet Security at Machine Speed: How Autonomous AI Agents Are Changing Cloud Defense

Speakers: Pujita Sahni & Geoff Sweet

Attackers are using frontier AI to compress the time between finding a vulnerability and exploiting it. Manual triage and human-in-the-loop remediation cannot keep pace. The answer is autonomous security that works at machine speed.

This talk covers the continuous AI-powered security loop and how autonomous agents are changing three SOC functions:

Autonomous triage. Agentic AI systems trained on real security decisions separate real threats from noise with high accuracy, reasoning across logs, configurations, reachability, and history. What takes analysts hours, these systems handle in seconds.

Validated remediation. The latest AWS security enhancements discover vulnerabilities, validate exploitability in sandboxes, and fix confirmed exposures with increasing autonomy. We walk through the journey from human-approved fixes to fully autonomous remediation.

Continuous offensive testing. AI agents that proactively test your applications throughout the dev lifecycle instead of once a year. Customized pen testing across your whole environment. We show what this looks like when an AI chains attack paths across services in real time.

The full loop. Discovery feeds triage, triage feeds remediation, remediation closes the gap before attackers exploit it. Integrated through AWS Security Hub with the tools you already use.

Real demos. Real attack paths. Walk away knowing where this technology stands and what first steps look like.

Pujita Sahni is a Delivery Consultant specializing in cloud security, risk, and compliance at AWS. In her role, she is responsible for architecting IAM governance frameworks and security automation solutions that enable organizations to implement secure cloud migrations and shift security left within enterprise environments. She brings a broad technical background across identity and access management, vulnerability management, infrastructure-as-code security, and DevSecOps practices, providing a comprehensive view of how security platforms are built, automated, and maintained across enterprise cloud environments.

Geoff Sweet has nearly 30 years of technology experience, starting from the late 90's during the dot-com boom. Geoff has worked in many verticals including Gaming, BioTech, Retail, and financial SaaS. He has held several titles through his career such as Systems Architect, Network Architect, and most recently Security Architect. These experiences have helped him to develop robust experiences in Infrastructure Security. Geoff left the customer side to come to AWS in December of 2019. He left SAP where he lead a small security team responsible for monitoring and doing Incident Response for nearly 10,000 cloud accounts over several cloud providers. Geoff has a proven record of speaking to customers in both small and large format settings. He is engaging, entertaining, and communicates in a way that assures everyone understands. Geoff's background is in Electrical Engineering and Mathematics and continues to use that knowledge to support his customers. He also has a deep fondness for all things automotive and extensive experience building and fabricating vintage cars.

🔨 Tool Demo by Ariz Soriano PurpleLoop: Closing the Loop Between Detection Rules, Log Schemas, and Purple-Team Validation

Speaker: Ariz Soriano

Sentinel deployments rot. Mid-market SOCs run 80 to 300 analytics rules, and a large haven't fired a true positive in 90 days. Many reference tables or columns that don't exist in the tenant because the rule was copied from a Microsoft post written for a different topology. The public Azure-Sentinel repo ships new content weekly and almost nobody reconciles against it. One layer deeper, Log Analytics ingests 20 to 80 tables per tenant, and most teams have never audited which have any coverage and which are dark. And almost nobody validates that the rules they do have actually fire against the techniques they claim to cover.

PurpleLoop is an LLM-augmented detection-engineering workflow built on one insight: rule authoring, coverage analysis, and purple-team validation are the same job, and they should be one tool. It does four things, none individually novel, never previously combined into one workflow:

- Reviews deployed rules by diffing against the live Azure-Sentinel repo and community libraries, flagging drift, dead operators, missing siblings.

- Suggests new rules from your actual workspace schema, not Microsoft's reference topology. A rule needing DeviceProcessEvents isn't suggested if MDE isn't onboarded.

- Generates purple-team scenarios and validates rules against them. The tool runs an atomic-style simulation, checks whether the rule fires, and patches the KQL if it doesn't. The loop closes itself.

- Builds a detection-gap map that distinguishes "no rule for this" from "no telemetry for this." Most coverage tools miss the second category.

The LLM provides the connective reasoning between the pieces. It is not in the codegen path. PurpleLoop reasons in a Sigma-inspired intermediate detection representation (IDR), and a deterministic compiler renders to KQL. The queries that run on your workspace are produced by code we wrote, not by pattern completion. Hallucinated columns and invented operators are eliminated at the compiler boundary, not at the prompt boundary.

What attendees take -

A working open-source tool installable in minutes, a reusable methodology not bound to Sentinel, and prompt-engineering patterns for security workflows where correctness matters. The talk argues the case, demos the tool live against a real tenant, and hands the code to the room.

Ariz Soriano is Associate Director of Red Team at Theos, with nearly a decade of experience spanning Red Teaming, Penetration Testing, and Incident Response. He started his career on the defensive side, working as a SOC analyst and eventually leading SOC and IR teams for his first four years in the industry. That defensive foundation gives him a perspective most purely offensive operators don't have. He built the Theos Red Team from the ground up, recruiting and training operators, designing red team infrastructure and tooling, and establishing the methodology and playbooks behind the team's APT simulation and purple teaming engagements. Today he runs a practice that delivers multiple concurrent engagements a year, balancing operations with presales, scoping, revenue targets, and people management. Outside of client work, Ariz is passionate building red team tooling, optimizing offensive workflows, and sharing knowledge with the community as a conference speaker. He also contributes to TryHackMe as a part-time Senior Content Engineer, creating hands-on cybersecurity labs and challenges based on real-world attack techniques.

💡 Talk by David Fiser The Hidden Cost of Agentic Connectivity

During our extensive research on MCP servers, we uncovered critical vulnerabilities that pose significant risks to the cloud infrastructure management. These vulnerabilities enable malicious actors to interact with and compromise organizational infrastructure. Alarmingly, while some MCP servers had implemented protective measures against such misuse, these measures were often flawed, allowing for trivial bypasses.

In this presentation, we will underscore the necessity of comprehensive visibility and robust policy guidelines for every organization. Our analysis of over 19,000 MCP servers reveals substantial gaps and vulnerabilities within the so-called security features of these systems. We will demonstrate how these security features can be bypassed and highlight the real-world implications of these vulnerabilities.

Through active scanning, we identified the same vulnerable MCP server implementations deployed in the wild, confirming that these vulnerabilities are actively exploitable. This underscores the urgent need for organizations to adopt a strategic approach to managing MCP servers.

Our aim is for attendees to understand th e critical importance of AI security beyond mere vulnerability management. Our findings show that even if the MCP server is not vulnerable, default deployments often introduce significant risks to organizational security. We will conclude our presentation by outlining best practices for mitigating the risks associated with MCP servers, ensuring that attendees leave with actionable insights to enhance their organization's security posture.

🔨 Tool Demo by Bleon "gl4ssesbo1" Proko Nebula - 5 years, still kicking *aaS

Speaker: Bleon "gl4ssesbo1" Proko

Nebula is a cloud C2 Framework, which at the moment offers reconnaissance, enumeration, exploitation, post exploitation on AWS, but still working to allow testing other Cloud Providers and DevOps Components.

It started as a project to unify all Cloud + DevOps Pentest and Security Techniques for a better assessment of the Infrastructures. It is build with modules for each provider and each functionality. Initially released in April 2021 as a bulk of scripts, it developed into a C2 framework, managed through a teamserver, allowing a team of pentesters to authenticate and access the tool, as well as a MongoDB database to save the results into. Offers modules for reconnaissance, initial access, enumeration, Command and Control, post exploitation, persistence and cleanup in AWS, Azure Graph and Management API, DigitalOcean, as well as a new release for GCP and GWS, Kubernetes and defense bypasses.

- Public Reconnaissance

- Brute-force and Password Spray

- Enumeration of internal resources after initial access

- Lateral Movement and Privilege Escalation

Ever since I pushed the last update, the tool has changed drastically. Now you will get a teamserver based tool, with a client and server split, authentication to access the tool, user management and a MongoDB database to save the results into.

Bleon is an Info-sec passionate Infrastructure Penetration Testing and Security, including Active Directory, Cloud (AWS, Azure, GCP, Digital Ocean), Hybrid Infrastructures, as well as Defense, Detection and Thread Hunting. He has presented topics related to Cloud Penetration Testing and Security in conferences like BlackHat USA, Europe and Sector, DEF CON, SANS Pentest Hackfest Hollywood and Amsterdam, as well as several BSides on USA and Europe.

His research include Nebula, a Cloud Penetration Testing Framework ( ) and other blogs, which you can also find on his blog ( blog.pepperclipp.com ). He is also the author of YetiHunter, DetentionDodger and Ransomwhen ( /[DetentionDodger | YetiHunter | Ransomwhen]).

🎙️ Panel Citizen Developers Can't Defend What They Built: Scaling Security Past the Security Team

Panelists: Alex Humphrey, Kevin McDermott, Laura Haller

Moderator: Evan Markl (Cloud Village Crew)

The operations, marketing, and finance staff shipping apps on low-code platforms and AI assistants are on track to outnumber your engineers four to one, and almost none of what they ship reaches a security review. When it fails, it fails wide: one default-public setting in Power Apps exposed 38 million records across 47 organizations. So how do they defend what they build, or do they? Push ownership outward with paved roads and policy-as-code, or wall off the blast radius and concede they never will? And when the citizen-built app is the breach, who answers: them, or you?

Alex Humphrey is a cybersecurity leader and speaker with more than 15 years of experience helping organizations solve complex security problems and build effective security programs. He specializes in putting security challenges in their proper organizational context, connecting technical decisions to business priorities, operational realities, and the people responsible for making security work. Today, Alex focuses on AI security and the practical application of AI in security operations. He works with organizations to understand their actual AI risks, separate meaningful concerns from industry hype, and adopt defenses that allow them to pursue their goals securely.

Kevin McDermott serves as Head of Security at Superhuman, where he leads teams across Product Security, Cloud/Platform Security, Detection and Response, and Threat Intelligence. Kevin cut his teeth as an application security practitioner before transitioning into leadership, bringing hands-on experience to his strategic role. He's built his career on creating security programs that work with engineering teams rather than against them.

Laura Haller is a Senior Infrastructure Security Engineer and fwd:CloudSec speaker with over a decade of experience in security engineering and cloud security from her time at Netflix, HashiCorp, Schwab, and Capital One. Her interests lie in working with engineering and non-engineering teams alike on practical security controls where context is critical and scale presents unique challenges. She holds a particularly-useful-at-DEF CON Electrical Engineering degree from the University of Illinois and is a passionate mentor for women entering the cybersecurity field.

⚡️ Lightning Talk by Gil Weizman & Tamir Yehuda Go with the Flow: Riding GCP Dataflow Shadow Dependency to Cross-Tenant Compromise

Speakers: Gil Weizman & Tamir Yehuda

Cloud resources rely on a web of trust that most security teams ignore. Even if you secure access to a resource, you might miss its "shadow dependencies" - the external, system-generated resources required for it to function.

GCP Dataflow is just the latest in a long trail of vulnerable services suffering from this architectural blind spot. What we found is a fundamental flaw in how Dataflow blindly trusts dependencies located far outside its IAM control and security boundaries.

In this talk, we’ll present two novel attack techniques that weaponize unvalidated config files to hijack trusted data pipelines. We’ll also demonstrate a critical cross-tenant vulnerability that extends this issue by enabling manipulation of Dataflow orchestration across tenant boundaries. The issue remains under responsible disclosure and is expected to be fixed before the presentation.

Background: GCP Dataflow and Managed Infrastructure

Organizations running large-scale enterprise data workloads increasingly rely on managed data-processing services, especially GCP Dataflow. Built on Apache Beam, Dataflow executes unified data pipelines while removing much of the operational burden of provisioning cluster frameworks, tuning virtual machines, and scaling infrastructure in response to demand. Teams define the pipeline, and Dataflow provisions and scales the underlying compute resources automatically.

During this orchestration, however, Dataflow pipelines often depend on objects stored in standard cloud storage buckets to control execution, such as code, templates, and environment configuration.

Pipelines routinely ingest and execute files from cloud buckets, including JavaScript or Python User Defined Functions (UDFs) for runtime transformation, structured YAML job templates that define pipeline parameters, and other environment configuration files.

Because these files and their supporting temporary assets are often managed through automated developer pipelines, they can become "shadows": overlooked in routine asset inventories and security posture reviews, yet still critical to the execution of highly trusted cloud workflows.

Dismantling the shadow resources blind spot: Understand how automated cloud orchestration creates short-lived access windows that can evade scheduled security scans and routine asset inventories.

Auditing the infrastructure-as-config attack surface: Learn to treat external execution blueprints as active attack surfaces rather than passive configuration files.

Applying defensive best practices: Take away architectural recommendations for designing pipelines that are more resilient to these attack paths.

Total duration: 20 minutes

5 minutes: Background on shadow resources and Dataflow mechanics.

10 minutes: Walkthrough of the attack paths and the cross-tenant vulnerability.

5 minutes: Research methodology, defensive takeaways, and detection strategies.

Gil Weizman is an experienced security researcher with over ten years of expertise across on‑prem, cloud, web, and SaaS security. Gil focuses on threat detection, product security research, vulnerability research and identifying gaps in security visibility across modern environments. Gil specializes in translating real‑world attacker behavior into improved detection and mitigation strategies.

Tamir Yehuda is a Senior Security Researcher and cloud security team lead at Varonis. He is a full-stack hacker with experience in malware analysis, Windows & AD domains, SaaS applications, and cloud infrastructure. Tamir specialize in IaaS & PaaS research focusing mainly on Azure, GCP, AWS, Salesforce, and ServiceNow. He brings over eight years of experience in various types of security research and red teaming

💡 Talk by Muskan Tomar The Polymorphic Agent: From Cross Agent Escalation to Just in Time Defense on Azure

Speaker: Muskan Tomar

A permission error halts conventional malware. AI agents are being assigned standing cloud IAM permissions and the autonomy to use them, a combination that breaks an assumption every existing control depends on. The agent reasons its way to an escalation path through the cloud provider's own IAM APIs. We call this the polymorphic agent. This talk presents research cross-agent privilege escalation between independent AI agents & defense around it.

The attack begins with a single poisoned tool description, rewritten to read like routine compliance guidance. The agent parses the injected text, reasons it, and grants itself elevated IAM roles. this showcases how a compromised Agent A modifies the role assignments of a separate Agent B, running a different framework in a seperate environment and never issued a malicious instruction, expanding Agent B's authority entirely through authorized IAM calls. This points directly to two risks named in the OWASP MCP Top 10: Privilege Escalation via Scope Creep (MCP02), achieved through Tool Poisoning (MCP03). To test whether this is agent-specific, we ran the attack across three production agents, including LangChain and Claude Code. All three escalated, the pattern is consistent: prompt-layer guardrails are reformable, human approval is socially engineer-able, and telemetry arrives too late.

These results frame two requirements for any workable defense: the escalation must be measurable in real time, and it must be blocked at a point the agent cannot reach. Enforcement has to move to the credential layer, since an agent cannot act on the cloud without first obtaining a credential. This is the gap PrivilegeGuard closes, an out-of-process credential gateway that intercepts DefaultAzureCredential and slots into existing agent deployments with minimal to no code change.

On each token request, it computes the requesting Non-Human Identity’s Blast Radius Score (BRS): the fraction of the cloud resource surface reachable by that identity across a two-hop IAM graph traversal, providers reachable under current role assignments plus those reachable after a simulated roleAssignments/write self-escalation. PrivilegeGuard evaluates BRS and its rate of change against an Open Policy Agent (Rego) policy and denies an anomalous, high-blast-radius request before the escalated role is usable.

The takeaway is architectural: cross-agent escalation follows from giving probabilistic, goal-driven agents standing IAM credentials, not from any single agent or framework, and it widens as agents gain access. We deliver the attack on real Azure identities, and an enforcement model that stops it where the agent cannot follow: the credential layer.

I am Muskan Tomar, a Security and Reliability Engineer at MICROSOFT, where I work at the intersection of Site reliability, Infrastructure Security, and Software Engineering building systems that are expected to never go down, stay secure, and scale quietly in the background. 5X Microsoft Azure Certified , with experience working on architecting and modernising, securing cloud platforms and reducing operational toil through automation, AI and data driven engineering.

My independent research focuses on AI agent security and cloud identity, and how autonomous agents change the threat model for systems we trust to stay locked down. An enthusiastic learner who champions collaborative cloud and security research, I enjoy untangling complex systems and eliminating single points of failure. Outside work, I love to travel and paint.

🎙️ Panel The New Software Supply Chain Nobody is Securing: MCP

Panelists: Tamir Yehuda, Jessie Jamieson, Paul McCarty

Moderator: Evan Markl (Cloud Village Crew)

MCP is the USB-C port for AI: one universal socket that lets an agent plug into your source, your SaaS, and the credentials on your developers' laptops. The threat model isn't the mystery anymore; OWASP and the NSA have written it down. The unsolved part is the one USB-C never fixed: what you let plug into the port, and what each thing's allowed to do once it's in. Plug in the wrong server and your own agent becomes the attacker. So what earns the right to connect and should MCP enforce that at the port, or is that on you?

Tamir Yehuda is a Senior Security Researcher and cloud security team lead at Varonis. He is a full-stack hacker with experience in malware analysis, Windows & AD domains, SaaS applications, and cloud infrastructure. Tamir specialize in IaaS & PaaS research focusing mainly on Azure, GCP, AWS, Salesforce, and ServiceNow. He brings over eight years of experience in various types of security research and red teaming.

Dr. Jessie Jamieson is a research mathematician with almost a decade of experience applying mathematical techniques to cybersecurity and decision making. After receiving a PhD in mathematics from the University of Nebraska-Lincoln, she moved to the DC area to use her mathematical expertise to support a number of government cybersecurity and AI-related initiatives. She’s now a mathemagician at Turngate, where she works on unifying SaaS audit logs and MCP telemetry into a single coherent picture so that defenders can actually see what AI capabilities do in their environments. Originally hailing from East Tennessee, she’s the person to ask if you’re planning a trip to DollyWood anytime soon.

Paul is the founder and maintainer of OpenSourceMalware.com the world's only community threat intel platform for software supply chain threats. He founded SecureStack in 2017 and SourceCodeRED in 2023. Paul is a DevSecOps veteran who focuses on software supply chain research, offensive training, and engagements, including deep work in the NPM ecosystem. He’s worked with organizations including NASA, Boeing, John Deere, the US military, and the Australian government, and is an active open-source contributor currently writing “Hacking NPM.” He also likes to snowboard with his family and throw sick cab 360’s off his toes!

💡 Talk by Aravind Sreekanth Pallavoor & Sadhana Sainarayanan Trust Fall: How Agentic AI Inherits Your Cloud's Worst IAM Habits

Speakers: Aravind Sreekanth Pallavoor & Sadhana Sainarayanan

Cloud IAM was designed for two principals: humans and machines. In 2026, a third has arrived: the autonomous AI agent and it plays by neither rule book. AWS Bedrock Agents, LangChain-based orchestrators, and multi-agent pipelines are being deployed with execution roles scoped to whatever the deploying engineer thought was "good enough," inheriting the same over-privileged IAM patterns that have plagued cloud environments for a decade. The difference: agents don't just misuse permissions accidentally. When adversarial manipulations are done, they weaponize them with precision.

This talk dissects the threat model of agentic AI systems from an attacker's perspective with a clear-eyed look at how autonomous agents become cloud privilege escalation engines. Drawing from the OWASP Top 10 for Agentic Applications 2026, MITRE ATLAS, and real-world research including Sonrai Security's AgentCore privilege escalation path and Unit 42's confirmation of autonomous AI-driven cloud attacks, the talk walks through a complete attack chain: indirect prompt injection against an agent's context window → tool misuse via over-privileged Lambda execution roles → IAM policy modification → persistent backdoor creation — all without a single stolen credential.

Attendees will leave with a structured threat model mapped to MITRE ATLAS tactics, a dissection of what AWS CloudTrail catches versus what it silently misses during agent-driven attacks, a breakdown of the three OWASP agentic risks most directly applicable to AWS environments (Goal Hijack, Tool Misuse, Identity & Privilege Abuse), and concrete defensive controls including agent-scoped least-privilege IAM, Bedrock Guardrails limitations practitioners need to know, and human-in-the-loop architectural patterns.

Aravind Pallavoor is a cybersecurity practitioner with over five years of hands-on experience spanning application security, cloud security engineering, and offensive security research. He holds CISSP, CEH (v11), and AWS Certified Security – Specialty (SCS-C02) certifications alongside a Master of Science in Cybersecurity, Technology and Policy from The University of Texas at Dallas, where he graduated with a 3.82 GPA.

His offensive security background includes web application and API penetration testing, mobile application security, AI chatbot security assessments — including prompt injection and training data poisoning research — and cloud infrastructure security across AWS environments. He has conducted security assessments for global financial institutions and enterprise SaaS organizations, applying frameworks including OWASP, CVSS, MITRE ATT&CK, NIST, PCI DSS, and CIS Foundations.

On the cloud side, Aravind has directly architected and audited IAM environments, deployed and red-teamed compliance automation pipelines, and operationalized AWS Config, Secrets Manager, and CI/CD pipeline security at scale. His research interest at the intersection of agentic AI and cloud identity — the subject of this talk — grew directly from real-world experience testing AI systems for adversarial manipulation and observing how autonomous tool use exposes cloud IAM to a new class of attack surface.

"Trust Fall" represents his synthesis of those two worlds: offensive AI security research applied to the cloud IAM threat model, grounded in published vulnerability research, OWASP's Agentic Top 10 for 2026, and MITRE ATLAS — and delivered without a lab, because the threat model speaks for itself.

Sadhana Sainarayanan is a Cloud Platform Security Analyst with experience across SAP BTP security operations, ML pipeline productionization and AI systems. She holds dual master’s degrees from Carnegie Mellon University in Engineering and Technology Innovation Management, and Civil and Environmental Engineering. Her independent projects span instrumentation for AI systems, focused on the gap between what agents report doing and what they actually do, execution auditing, and behavioral divergence detection.

💡 Talk by Jenko Hwong & Chris Ryan Bashing CloudShells for mining, networking, exfil and persistence at scale

Speakers: Jenko Hwong & Chris Ryan

CloudBashing started with reversing the private AWS, Azure, and GCP CloudShell REST protocols, analyzing websocket terminal sessions, and tracing janky browser authentication/credential flows with cookies and OAuth tokens. Along the way, we automated the APIs to access free CPU/networking, maintained access across container/VM resets, utilized persistent $ for implants/data, locked users out of sudo access, and installed a C2 framework. We discovered IAM design issues like: AWS role assumption that result in a large # of environments per compromised identity, web socket sessions that survive API token revocation, and M365/Gmail consumer email accounts that have default CloudShell access. This turned into a newly released exploit toolkit, CloudBasher, that enumerates, validates, installs, and runs distributed workloads with virtual storage and private networking across a large-scale agent network with persistence and resilience. We'll demo distributing CPU-intensive workloads, using virtual storage for staging/exfiltration, secure networking for proxy and obfuscated exfil paths, while automating the discovery, enumeration, creation of CloudShell environments from initial credentials/sessions to implants/setup/networking to management and control.

Jenko Hwong is a Principal Security Researcher at Huntress Labs, focusing on identity-based attacks and cloud abuse. Prior to Huntress, he spent 6 years at Netskope Threat Labs, has spoken at RSA and DEFCON, and is a Cloud Village Lead. He has spent an odyssey playing Sisyphus at security companies in cloud detection/response, vulnerability scanning, AV/AS, pen-testing, L3/4 appliances, threat intel, and windows security. He hates OAuth with a passion, would like to kill -9 Lost Lazy Mindless tools/people, and wishes insecure-by-default-security-vendors were forced to eat-their-own-crap.

A series of oddly configured server banners, a JARM fingerprint, curious fields in a security certificate - these aren't just technical details, but are instead threads in a narrative tapestry woven like a John le Carre novel. For over 20 years, Chris has dedicated his life to studying these threads and the intersection between cybersecurity, Russian linguistics, and free and open source software. His career path has taken detours through academia, aerospace and defense, software development, and cybersecurity.

💡 Talk by Jai Kumar Sharma & Tom McCarthy Ghost Records: Automating Dangling DNS & Subdomain Takeover Detection at Enterprise Scale

Speakers: Jai Kumar Sharma & Tom McCarthy

This is not another subdomain takeover 101 talk. It's what dangling DNS actually looks like at enterprise scale - in large, multi-account AWS environments with sprawling DNS footprints - and the automation and hard-won triage lessons the problem demands.

Let's be honest: ~95% of subdomain takeover findings are noise - 3rd- and 4th-level subdomains on dead non-prod environments no customer ever visits. They generate alert fatigue and little else. The other 5% - cookie theft via a *.domain.com scope, OAuth token hijack, phishing from a legitimate domain carrying a valid TLS cert - are catastrophic. Telling the 5% from the 95% is the entire game.

Then there's the bug bounty dynamic. Researchers find these in bulk and report them in bulk. They're frustrated that fixes take weeks; program owners are frustrated that most reports are low-impact but can't simply be closed. The relationship erodes on both sides - a cost nobody puts on a dashboard.

From what We've seen, the time sinks are predictable: manually triaging hundreds of researcher reports, chasing low-impact findings, writing one-off fix scripts instead of systemic solutions, and reconstructing record ownership after the fact. The structural causes are just as consistent: multi-account sprawl with no central DNS ownership, rapid dev cycles where IaC teardowns never touch Route53, and researchers reporting faster than teams can remediate.

The core of the talk is architecture: automatically cross-referencing every Route53 A record and CNAME against Elastic IPs allocated across all AWS regions, wired into ownership routing and shift-left pipeline hooks. Done right, this shifts detection from reactive to proactive, can take MTTR from weeks to hours, and eliminates entire classes of records at the source.

We'll release Ghost Records, an open-source tool aimed at the one of the highest impact vector: dangling A records and CNAMEs pointing to released or unallocated AWS Elastic IPs. It inventories every EIP across all enabled regions, cross-references them against Route53, and flags any DNS record pointing to an IP the account doesn't own. Read-only, multi-account, parallel scanning, risk-scored output. Live demo included.

Jai Sharma is a Principal Offensive Security Engineer at GoDaddy, where he leads cloud penetration testing, red team operations, AI red teaming, and security research across one of the world's largest domain registrars and hosting platforms. A self-taught offensive security researcher from New Delhi, India, he built his career with a hacker's mindset, breaking code logic, chasing vulnerabilities, and proving real-world business impact from technical exploits. He also leads TTP research, drives threat emulation efforts, and works closely with blue teams to sharpen detection through an adversary-focused lens.

At GoDaddy, Jai tests the same infrastructure and enterprise environments that millions of customers rely on. His work spans cloud and on-premises penetration testing, IAM privilege escalation research, and building automated offensive tooling that helps turn point-in-time assessments into continuous detection. Before GoDaddy, Jai held offensive security roles at Housing.com, FIS, and EY, giving him firsthand experience with how security weaknesses and misconfigurations surface across different industries, architectures, and maturity levels.

Jai volunteers with the DEF CON community as CTF Ops for the Cloud Village and on-site Coordinator for the Bug Bounty Village.

Tom McCarthy is the Director of Offensive Security and Business Information Security Officer at GoDaddy, where he oversees penetration testing, red team operations, and security strategy across multiple lines of business. With over 15 years in offensive security — spanning consulting, penetration testing, research, and training — Tom has built multiple penetration testing teams from the ground up and led or managed hundreds of penetration tests and red team engagements throughout his career. Tom is a returning DEF CON speaker, having previously presented research, tooling, and training at both DEF CON and DerbyCon. He has contributed to open-source offensive security projects including smbexec and Metasploit, and served as a trainer in hacking and incident response for local, federal, and military organizations across multiple countries.

💡 Talk by Shane Young Trust the Cloud Pipeline, Lose the Kingdom

In 2020, SolarWinds showed the industry what it looks like when an attacker owns a build pipeline. In 2021, Codecov did it again. CircleCI in 2023. Each incident surfaced the same pattern. Cloud CI/CD systems sit at the center of a trust graph most organizations have never actually mapped, and compromising them grants access to everything downstream: source code, cloud infrastructure, production artifacts, customer data, and every third party platform the organization stores credentials for. Detection remains largely absent.

Five years after SolarWinds, red teams still rarely operate meaningfully against cloud native CI/CD. Most offensive security programs treat pipelines as infrastructure they inherit rather than terrain they fight over. Defenders build detection around endpoints and identities they recognize, while ephemeral build agents with elevated cloud credentials run continuously and unmonitored.

This talk presents a full cloud native CI/CD attack chain drawn from red team engagements across multiple enterprise cloud environments. The chain starts at a low privilege developer identity. Pull request poisoning, in both direct and indirect variants, exfiltrates temporary AWS credentials from the build agent. A scheduled Lambda function then relays fresh credentials before each expiry, providing durable serverless persistence with no endpoints, no implants, and no signals a traditional detection stack watches for. IAM role trust chain abuse escalates the compromised build identity into broad cloud access spanning multiple accounts. Finally, Secrets Manager extends the attack beyond AWS. The credentials stored inside grant organization admin access to the code hosting platform, administrative control of the CI platform itself, access to customer data warehouses, and access to every SaaS and third party system the organization depends on.

Shane Young is an offensive security operator and program builder with over 15 years in the field. His career spans consulting across financial services, hardware, and SaaS; building out an IoT security practice at a major security consultancy; leading red team operations against cloud native product companies; and pioneering AI/ML red teaming for deployed enterprise AI features. He builds offensive security programs from scratch, runs red team operations end to end, and still carries significant technical IC workload because he thinks that is how security leaders stay sharp. He has been hacking since he was a teenager, and it still has not gotten old.

⚡️ Lightning Talk by Moshe Berntsein Whose Resource Is It Anyway? The Design Flaw That Breaks the IAM Permission Model

Speaker: Moshe Berntsein

The major cloud provider’s permission model is simple: use IAM to keep the bad guys out of your cloud environment. But what if the bad guys could lure victims in? Each provider implements IAM differently, and in this talk, we will explore a hidden quirk in the GCP identity boundary that allows attackers to invert the permission model and force victims into a malicious environment.

We will examine the unique aspects of GCP IAM and explore how a core design choice enabled cross-tenant account takeover via a novel vulnerability I discovered in Vertex AI Workbench, potentially leading to full cloud compromise.

The biggest threat to your cloud environment could be a project you didn’t even know you were a part of.

Moshe Bernstein is a Senior Security Researcher specializing in cloud vulnerability research at Tenable. With over a decade of experience in cybersecurity, Moshe has developed a strong focus on network and operational security, web vulnerability research, and cloud infrastructure security. He enjoys presenting his research at conferences around the world, and is always on the lookout for new challenges.

💡 Talk by Doron Kapah Pinchy Gets Played: How We Red-Teamed AI Agents Before the Threats Did

AI agents are showing up in cloud workflows with credentials, autonomy, and trust, but so are the threats targeting them. So, before attackers started probing them, Varonis Threat Labs did.

We built a target agent named Pinchy on the OpenClaw platform and put it through a red-team gauntlet using well-known techniques. Pinchy handled sophisticated technical attacks with ease but folded immediately against simple social ones. The same drive to be useful turns these agents into an attack surface that requires entirely different defensive strategies. for a deep dive on the new risks autonomous AI brings to the cloud. You'll leave with a clearer picture of where AI agents fail, why the threat model is unlike anything that came before it, and what architectural controls — not prompts, not policies —

actually keep environments secure.

🔨 Tool Demo by Ritvik Arya & Kyle Quest Minimal by Design: Building Hardened Near-Zero-CVE Container Images

Speakers: Ritvik Arya & Kyle Quest

Most production containers ship on base images with dozens of known CVEs — debian:latest currently sits at 127. Patches take weeks. Your compliance team isn't happy. We built "minimal" — an open source project producing 36 hardened (and adding more), distroless container images for the stack most cloud teams actually run: Python, Node, Go, Redis, PostgreSQL, MySQL, Kafka, Nginx, Prometheus, Jenkins, and more. Image runs as non-root, has no shell, ships with a signed SBOM, and is rebuilt daily so CVE patches land in under 48 hours instead of 30 days.

This talk is a practical walkthrough of how you build something like this from scratch using entirely open source tools — and what could go wrong. We'll cover the toolchain: Chainguard's melange for sandboxed source builds, apko for declarative image assembly,Wolfi as the package base, Grype for scanning, and cosign for keyless signing.

We'll show the CI pipeline — 60 parallel GitHub Actions jobs, native ARM64 runners, ephemeral signing keys for PRs, multi-arch manifest assembly — and the 24 automated update workflows that track upstream releases daily across GitHub tags, RubyGems, php.net, and Wolfi's APKINDEX. We'll close with live Grype scan comparisons against official Docker Hub images. The numbers are dramatic, and they make the case better than we can. Every source build is SHA256-verified, and every assembled image is tested in CI before publishing — tests for no shell, correct entrypoint, expected binaries present, services responding.

Everything is open source and running in production today. If you leave this talk and build your own hardened container pipeline the week, we've done our job.

Ritvik Arya is an Application Security Engineer at Amazon Web Services specializing in cloud security, container security, and offensive security research. His work focuses on securing large-scale cloud-native applications, building hardened container ecosystems, and developing scalable AppSec automation and vulnerability discovery tooling.

Kyle is the creator of DockerSlim, a popular tool to secure and optimize containers. His area of focus is autonomous and secure cloud-native infrastructure, sandboxing and agent security. With over two decades in security, Kyle had a chance to wear many different hats as a builder, breaker, and defender. Currently reverse engineering coding agents like Claude Code for fun AND profit.

💡 Talk by Dan Gansel What's Behind the Curtain? Tearing Down AWS's AI Agent Runtime From the Inside

When you deploy an AI agent to AWS Bedrock AgentCore, your code lands in a container inside a Firecracker microVM - and AWS tells you almost nothing what else is in there with you. So we decided to find out.

We started with nothing but a Python process in a container and a lot of patience. What began as hand-parsing `/proc/net/tcp` to find open ports and reconstructing the process tree from `/proc/[pid]/cmdline` quickly turned into something much bigger - the container wasn't alone, and the things running alongside it weren't expecting visitors.

Breaking out of the container gave us access to the microVM filesystem and let us extract four unstripped Rust platform binaries. But it was the second trick that really opened things up: by manipulating the container's metadata and log configuration, we got AWS's own logging pipeline to ship us the platform's internal logs - boot sequences, lifecycle state transitions, TLS certificate provisioning, hypervisor handshakes, and error messages the platform was never meant to with customers.

Between the inside-out reconnaissance, the extracted binaries, and the captured logs, a complete picture emerged of something Amazon internally calls "Project Kepler" - an undocumented platform that has never been publicly described. We'll walk through every technique we used to peel back the layers, what we found at each one, and what it tells us how AWS builds isolation for managed AI workloads.

Dan Gansel is a cloud security specialist with deep expertise in cloud API research, secure cloud solutions and architecture design. Dan has led cloud security research teams and has a track record of uncovering novel attack techniques in cloud environments.

As a Security Researcher at Upwind Security, Dan continues to push the boundaries of cloud security, focusing on uncovering blind spots in the services organizations trust the most.

🎙️ Panel Autonomous Offense vs. Autonomous Defense: Who's Winning in the Cloud?

Panelists: David Fišer, Michael Chan, Nick Nolen

Moderator: Evan Markl (Cloud Village Crew)

An...