<img src="https://ml.globenewswire.com/Resource/Download/5aa9e2cd-a29f-421b-8f01-d18e01e9a472?size=2" nborder="0" align="left" hspace="5" vspace="5" title="Token Security_Logo_Black_4x (1).png" alt="Token Security Co., Ltd."/>Session will explain a vulnerability and multi-stage attack scenario that results in a full AI platform account takeoverTEL AVIV, Israel and NEW YORK, May 28, 2026 (GLOBE NEWSWIRE) -- <a href="https://www.globenewswire.com/Tracker?data=ZXcW5EahzWAPUPZXGZZrJWDit28LUx3mJ9pjFb0M-KkCovYNs6jKbuWimu-OWmTFdbsSmcBWOwOAv0bODBApi89yHH0dZ_CCBYRuheSG0aM=" rel="nofollow" target="_blank" title="">Token Security</a>, the leader in identity-first AI agent security, today announced that Yair Balilti, Security Research Team Leader, will present new vulnerability research at <a href="https://www.globenewswire.com/Tracker?data=7cfnhnOFM1LAPtGiaWXKxkNr30o2eyK2D8RNz2n653ryOtSDWznqywn5Y67x9UyIfOCAqncIEEnMZH94QSK98fNBcUJfhqk_sE4RdsPHsO6o0CAW5tvNHOMYioLwqA5SkENneCENidCJHZOC2LD1Tg==" rel="nofollow" target="_blank" title="">fwd:cloudsec North America</a> on June 1, 2026, demonstrating how a chained exploit targeting automation platforms and serverless environments can escalate to a full Zapier AI platform account takeover. <img alt="image" data-mce-style="display: block; margin-left: auto; margin-right: auto;" height="314" src="https://ml.globenewswire.com/Resource/Download/6f098d3a-925b-4600-8587-da4c724c0ea1/image.png" style="display:block; margin-left:auto; margin-right:auto;" width="600" data-dpi="96" data-caption="Best practices for securing automation platforms and AI agent-driven workflows" data-filename="image.png" /> For complete details on the research findings, visit: <a href="https://www.globenewswire.com/Tracker?data=QLlmI29q_gEvTyD2GqkgXlZjLPlbijjEjCeQ5bdwZ249wCbgjae91AigIEPa8FT0YBhoSCVM-zIdEYojLWp9MrsXA9iDjbzWJQ0jfC5yOftKs80mF2eoxiYj5F5pniq8m-8pYXAd4gE-vYFvYay7Sw==" rel="nofollow" target="_blank" title="">https://www.token.security/zapocalypse</a>. WHO: Yair Balilti, Security Research Team Leader, Token Security, is an expert in vulnerability research and offensive security. He leads research focused on uncovering vulnerabilities in cloud-native and AI-driven systems, with a particular emphasis on how automation platforms and AI agents introduce new attack vectors. WHAT: Automation platforms and AI agents are increasingly acting as the high-privilege control layer of modern enterprises. As these systems gain access to APIs, credentials, and workflows, they also create new and poorly understood security risks. The research reveals how AI automation platforms are generating highly-privileged identities that are not being monitored or governed. In this session, Balilti will deconstruct a multi-stage exploit chain targeting Zapier users that begins in a sandboxed Python environment and escalates into full AI platform account takeover. The research challenges common assumptions about serverless isolation and secret handling, demonstrating how attackers can recover sensitive credentials directly from memory and move laterally across integrated systems. The session will cover: <ul type="disc"><li style="margin-top:12pt;">How hardcoded Model Context Protocol (MCP) keys and high-privilege tokens are exposed</li><li>Why Python’s del keyword does not reliably sanitize sensitive environment variables</li><li>How orphaned AWS STS tokens can be extracted from Lambda memory via /proc/self/mem</li><li>A technique for API-only ECR image extraction</li><li style="margin-bottom:12pt;">A dependency poisoning attack leading to Stored XSS across thousands of integrations </li></ul> Attendees will leave with: <ul type="disc"><li style="margin-top:12pt;">A technical checklist for auditing AI “code block” and automation features</li><li>Strategies for identifying and eliminating orphaned secrets in serverless environments</li><li style="margin-bottom:12pt;">Best practices for securing automation platforms and AI agent-driven workflows </li></ul> WHERE: fwd:cloudsec North America. Room 1. Meydenbauer Center, Bellevue, Washington. WHEN: Monday, June 1, 2026 at 10:50 AM PDT HOW: To speak with Yair Balilti, contact Marc Gendron at marc@mgpr.net, +1 617 877 7480. About Token Security <a href="https://www.globenewswire.com/Tracker?data=ZXcW5EahzWAPUPZXGZZrJQvcKzw4uo11c_YGCks8kUMQokw_F7kZgfOnsP6XGCl7VBF8fdMckxrUgKnri9sbEw==" rel="nofollow" target="_blank" title="">Token Security</a> accelerates the secure adoption of agentic AI by discovering AI agents across the enterprise, understanding their context and risk, and enforcing policies that govern their access and behavior. The platform provides continuous visibility, lifecycle management, and least-privilege enforcement to help organizations control autonomous AI agents operating across cloud, SaaS, and enterprise environments, eliminating blind spots, reducing risk, and ensuring compliance at scale. Token Security is backed by Notable Capital, Crosspoint Capital, and TLV Partners. To learn more: <a href="https://www.globenewswire.com/Tracker?data=LOV0doF6alnI58tf8L4ILnkUSgtIwcvAawvaBB9-6-DqZ2r_I7NNzm55DCjmyKI9PYdieiWQIeshcwT73JwbTzm5OhAj16wVAWmngzbgtVs=" rel="nofollow" target="_blank" title="">token.security</a>. Media Contact: Marc Gendron Marc Gendron PR for Token Security +1 617 877 7480 <a href="https://www.globenewswire.com/Tracker?data=xlAyZZSwGrIH-RX60zwb-SW0yOGaDSE9zdFUF1Ap8rHDUjyCmGek-wnA35NABXHhc_A_YGgPlfyj26O67B8Ufw==" rel="nofollow" target="_blank" title="">marc@mgpr.net</a> A photo accompanying this announcement is available at <a href="https://www.globenewswire.com/Tracker?data=QLlmI29q_gEvTyD2GqkgXgsmvX9UPa7zU9J13vLsC_1Poxtzy8W63OE_UGSOPck6NxsZG5z1nYpMKrD0CJshzlvAgsV-dIRLA0-bPkI2Hv3XhFugE6RScrsF9NtCSm0QP093aqL0UhrNMWHv6-noHnJb365cF89VXf69cFFUtqzjcaSnwOba5P_ZD2Y4MLeZ2c1dlExw1FkWKADePzvHnpS0wjTmpQbcuisWoJ9YzFManeLKq6aMfyd0I_eMiwXiYgyqEAGxz7mSa7bus9mDyg==" rel="nofollow" target="_blank" title="">https://www.globenewswire.com/NewsRoom/AttachmentNg/6f098d3a-925b-4600-8587-da4c724c0ea1</a> <img alt="" src='https://ml.globenewswire.com/media/OTlkNWFmZjAtYjAzOS00ZTExLTk1NmYtNDUxNTU1YzliNDMwLTEzMTgxNjYtMjAyNi0wNS0yOC1lbg==/tiny/Token-Security-Co-Ltd-.png' referrerpolicy='no-referrer-when-downgrade' />

GlobeNewswire Inc.

Token Security Researcher to Present “Zapocalypse” Exploit Chain Targeting Zapier Users at fwd:cloudsec North America

Latest news from the world of business and finance – both local and global

MONEY FM 89.3 is Singapore's first and only Business and Personal Finance station, featuring local and international business and financial news.

MONEY FM 89.3

Discover newsletters from our DJs on LinkedIn