Moeez Khan
Software Engineer @ Amazon Web Services • AWS Agentic AI • Enterprise & Mainframe Modernization
Dallas, Texas, United States
Actions
Moeez, a first-generation learner from a small Asian village, has built a dynamic, multidisciplinary journey through technology, education, and leadership, beginning with a pursuit of Physics.
Currently, Moeez is building AWS Transform, the first-ever Agentic AI service focused on transforming .NET, mainframe, and VMware workloads. This work centers on accelerating enterprise modernization across full-stack Windows, mainframe, and VMware systems, alongside enabling custom transformations of APIs, codebases, frameworks, and more.
Aside from technical responsibilities, Moeez actively participates in international hackathons, public speaking on Agentic AI and enterprise modernization, and mentors junior engineers, finding fulfillment in guiding their career paths. Moeez also champions the mantra of networking, embracing failures, and inclusion, advocating for greater impartiality within the tech industry. Through these efforts, Moeez positions himself not only as a technical contributor but also as a catalyst for meaningful and lasting change.
[Disclaimer: The opinions shared in Moeez's talks are solely his own and do not reflect those of his current or past employers, nor do they convey any confidential information.]
Links
Area of Expertise
Topics
Promptware: How Attackers Exploit Agentic AI and What Defenders Actually Do About It
[Disclaimer: The opinions, insights, and perspectives shared in this session are solely my own and do not reflect those of my current or past employers, nor do they convey any confidential information by any means.]
Note (07/11/26): Awaiting employer approval before sharing the detailed and complete session description to respect guidelines and comply with policies.
Overview:
In July 2026, Sysdig documented JadePuffer - the first confirmed fully autonomous agentic ransomware campaign: reconnaissance, credential theft, lateral movement, privilege escalation, and file encryption, end-to-end, no human at the keyboard.¹ The breach window for agentic AI attacks has collapsed to 22 seconds from initial access to handoff - compared to approximately 8 hours in traditional attacks.² CVE-2025-53773 (CVSS 9.6) demonstrated that a hidden prompt injection in a pull request description could trigger remote code execution through GitHub Copilot; CVE-2026-22708 let attackers poison Cursor's execution environment, allowing arbitrary payloads to be delivered.³ This is not a theoretical threat surface. The attack chain is documented, reproducible, and it targets developers and the tools they trust. This session breaks down how promptware actually works, how the kill chain executes, and what defensive architectures can actually stop it - not the ones that look good in a slide deck.
Structure:
Part 1: The Promptware Kill Chain - Anatomy of an Agentic Attack
(Prompt Injection → Tool Misuse → Lateral Movement → Exfiltration)
Prompt injection is not a chatbot annoyance - it is a multi-stage malware delivery mechanism. We walk through the documented attack progression: indirect injection via retrieved content, tool invocation using the agent's own authorized credentials, lateral movement through MCP server trust boundaries, and data exfiltration through communication channels the agent was designed to use. The JadePuffer kill chain is the case study. Every stage is mapped to a concrete TTP. No marketing diagrams - actual attacker decision-making reconstructed from incident reports.
Part 2: The Developer Supply Chain Is the New Perimeter
(Malicious MCP Servers, IDE Injection & CVE Walkthrough)
Researchers caught the first malicious MCP server in the wild in 2026: a package that shipped fifteen clean versions before quietly adding a single exfiltration line.⁴ CVE-2025-6514 (CVSS 9.6) hit the core MCP infrastructure used by hundreds of thousands of developers. CVE-2025-53773 hit GitHub Copilot via a PR description. The pattern is consistent: attackers are poisoning the content that developer-facing AI agents are designed to trust - code comments, documentation, pull requests, and retrieved context. We cover the attack anatomy, the trust model that makes it work, and why traditional SAST/DAST pipelines don't catch it.
Part 3: Defensive Architecture That Actually Works
(What Stops the Kill Chain and What Doesn't)
Model-layer filtering doesn't stop promptware - the attack bypasses it by design. We cover the architectural controls that actually interrupt the kill chain: tool call validation and schema enforcement at the integration layer, least-privilege service account scoping per the CNCF agentic standards, just-in-time credential provisioning, MCP server isolation, and runtime anomaly detection as the last-resort signal when upstream controls fail. We also cover what doesn't work - and why teams keep deploying it anyway.
Attendees leave with:
- A concrete threat model for promptware attacks mapped to documented 2025–2026 CVEs and incidents
- The kill chain decomposition from the JadePuffer and GitHub Copilot incidents in defender-actionable form<|join|>- The kill chain decomposition from the JadePuffer and GitHub Copilot incidents in defender-actionable form
- An architectural checklist of controls that interrupt the promptware kill chain at each stage
- A clear taxonomy of what model-layer vs. architecture-layer vs. runtime-layer defenses actually cover - and their gaps
This is not about whether AI is going to be used offensively. It already is, autonomously, against production systems. The question is whether your defenses were built for the threat that actually exists.
Citations:
¹ Sysdig / CyberScoop, "Sysdig clocks first documented case of agentic ransomware (JadePuffer)," July 2026. cyberscoop.com
² Jazz Cyber Shield, "Agentic AI Cyber Attacks in 2026: The 22-Second Breach Window," 2026. blog.jazzcybershield.com
³ Vectra AI, "Prompt injection: types, real-world CVEs, and enterprise defenses," 2026. vectra.ai
⁴ Blog.cyberdesserts.com, "AI Agent Security Risks 2026: MCP, OpenClaw & Supply Chain," 2026.
Sources:
- Sysdig - Agentic ransomware JadePuffer via CyberScoop: https://cyberscoop.com/sysdig-judepuffer-ai-agentic-ransomware-attack/
- The Promptware Kill Chain - arXiv: https://arxiv.org/pdf/2601.09625
- Agentic AI Cyber Attacks: The 22-Second Breach Window: https://blog.jazzcybershield.com/agentic-ai-cyber-attacks/
- Prompt injection: types, real-world CVEs, and enterprise defenses: https://www.vectra.ai/topics/prompt-injection
- Agentic AI Used to Conduct Ransomware Attack via Langflow - SecurityWeek: https://www.securityweek.com/agentic-ai-used-to-conduct-ransomware-attack-via-langflow/
Agentic AI Systems Don't Fail at the Model Layer - They Fail in Production
[Disclaimer: The opinions, insights, and perspectives shared in my session and its details are solely my own and do not reflect those of my current / past employers.]
Note (4/29/26):
Awaiting employer approval before sharing the detailed and complete session description to respect guidelines and comply with policies.
Overview:
The most expensive lesson enterprises are learning is this: Agentic AI failures are not model failures - they are system design failures. The model is rarely the problem; the architecture around it is. Gartner predicts over 40% of agentic AI projects will be canceled by 2027 - not because models underperformed, but due to governance gaps, uncontrolled costs, and systems never designed to be reliable.¹
Structure:
Layer 1: Tool Connectivity and the Integration Problem ("MCP & Tool Schema Designs")
Layer 2: Context, Memory, and the Limits of RAG ("RAG vs. Knowledge Graphs")
Layer 3: Multi-Agent Coordination and Failure Isolation ("Orchestration & Agent-Washing")
Citations:
¹ Gartner, June 2025 press release - over 40% of agentic AI projects to be canceled by 2027
Agent in the Cluster: The Cloud-Native Attack Surface Nobody Planned For
[Disclaimer: The opinions, insights, and perspectives shared in this session are solely my own and do not reflect those of my current or past employers, nor do they convey any confidential information by any means.]
Note (07/11/26): Awaiting employer approval before sharing the detailed and complete session description to respect guidelines and comply with policies.
Overview:
In May 2026, the Sysdig Threat Research Team documented the first confirmed agentic threat actor (ATA) kill chain on Kubernetes: a compromised LLM harness exploited a vulnerable notebook, replayed stolen service-account tokens to dump the cluster's entire Secret store, and executed container escape - fully automated, with no human operator in the loop.¹ The original Kubernetes threat model assumed the thing inside the pod was a stateless web service. An agentic AI workload is categorically different: when an agent is compromised, the attacker inherits its tool surface, its credentials, and its authority to act. RBAC misconfigurations already account for over 35% of Kubernetes breaches² - agentic workloads amplify that blast radius in ways the cluster was never designed to contain.
Structure:
Layer 1: Why the Kubernetes Threat Model Breaks for Agentic Workloads
(Service Account Scope, automountServiceAccountToken & Token Replay)
Most agent pods are deployed with service accounts scoped far beyond what the agent actually needs - because nobody planned for the agent to be the attacker's entry point. We cover how token auto-mounting + over-permissioned service accounts create an immediately exploitable path from prompt injection to cluster-wide Secret access, how the ATA kill chain from the Sysdig incident actually executed, and the minimal RBAC pattern every agent pod should start from: `automountServiceAccountToken: false`, namespace-scoped Roles, and just-in-time credential provisioning per CNCF agentic standards.³
Layer 2: MCP Servers as Pod-Level Attack Surface
(Container Hardening, Namespace Isolation & Schema Trust)
MCP servers running inside the cluster are becoming a default integration pattern for agentic tool connectivity - and each one is a trust boundary that needs to be hardened independently. A minimally scoped MCP pod looks very different from what most teams ship: its own namespace, dedicated service account, restricted Pod Security Admission profile, and schema validation on every tool call. We cover container-based lateral movement (up 34% in 2025²), what a malicious or compromised MCP server can access in a default cluster configuration, and the hardening checklist to close those gaps.
Layer 3: Observability as a Security Control for Agent Workloads
(Detecting Agentic Failure Through Runtime Signals)
In agentic systems, the first observable signal of a security event is often not an alert - it's an anomaly in query volume, API call rate, or inter-pod traffic that no existing dashboard was watching for. We examine how to extend cluster observability for agent-specific signals: detecting uncontrolled agent spawning through pod creation rate, identifying token replay through API server audit logs, and using resource consumption spikes as a canary for compromised agent behavior. Runtime protection and configuration drift detection are the last line of defense when prompt injection bypasses every upstream control.
Attendees leave with:
- A threat model for agentic workloads on Kubernetes grounded in the 2026 CNCF agentic standards
- A pod-level hardening checklist: service account scoping, `automountServiceAccountToken`, Pod Security Admission (restricted profile), and namespace isolation for MCP servers
- Observability patterns for detecting agentic security events through runtime signals before exfiltration completes
- A just-in-time credential provisioning pattern as an alternative to over-permissioned service accounts
These patterns are not theoretical - a threat actor already ran this playbook on a production cluster in 2026. The question is whether your agent workloads are hardened before the next one does.
Citations:
¹ Sysdig Threat Research Team, "Agentic threat actor hits the orchestration plane: AI agent-driven container escape," May 2026. sysdig.com
² Vector Labs, "Running AI Agents on Kubernetes: The Security Architecture Gaps Most Teams Discover Too Late," 2026. vector-labs.ai
³ CNCF, "Cloud native agentic standards," March 2026. cncf.io/blog
Sources:
- Sysdig - Agentic threat actor hits the orchestration plane: https://www.sysdig.com/blog/agentic-threat-actor-hits-the-orchestration-plane-ai-agent-driven-container-escape/
- CNCF - Cloud native agentic standards: https://www.cncf.io/blog/2026/03/23/cloud-native-agentic-standards/
- CNCF - Why cloud native belongs at the heart of agentic AI: https://www.cncf.io/blog/2026/06/17/why-cloud-native-belongs-at-the-heart-of-agentic-ai-lessons-from-building-a-multi-agent-security-platform-on-kubernetes/
- Vector Labs - Running AI Agents on Kubernetes: https://vector-labs.ai/insights/running-ai-agents-on-kubernetes-the-security-architecture-gaps-most-teams-discover-too-late/
- KubeFence: Security Hardening of the Kubernetes Attack Surface: https://arxiv.org/pdf/2504.11126
BSides DFW 2026 Sessionize Event Upcoming
The Commit Your Code Conference 2026! Sessionize Event
Cloud Native Dallas User group Sessionize Event
Moeez Khan
Software Engineer @ Amazon Web Services • AWS Agentic AI • Enterprise & Mainframe Modernization
Dallas, Texas, United States
Links
Actions
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top