Rogue Agent Vulnerability Undermines Security of Google Dialogflow CX

Varonis Threat Labs identified a vulnerability in Google Cloud Platform’s Dialogflow CX service that permits an attacker with a single `dialogflow.playbooks.update` permission to inject malicious Python code via the Playbooks “Code Blocks” feature. The injected code runs in a shared Google-managed Cloud Run environment, allowing persistent alteration of the execution engine, silent exfiltration of conversation data, and large-scale phishing attacks. Google released an initial patch in April 2026 and a full remediation in June 2026; no public exploitation was observed before the fix.

Hackernoon

Dialogflow CX uses Playbooks to orchestrate conversational flows. Code Blocks let developers embed custom Python logic that executes inside a Cloud Run container. All agents in the same GCP project share this container, which has unrestricted outbound internet access and a writable file system. Because the execution environment is managed by Google, customers lack visibility into its configuration. The vulnerability stems from the fact that the system concatenates the user-supplied Code Block with internal code and passes the result to Python’s `exec()` function, granting the block direct access to variables such as `history` (full conversation transcript) and `state` (session identifiers).

Hackernoon

• The flaw was first reported by Varonis in November 2025.

Hackernoon

• Google’s patches arrived in April 2026 (initial) and June 2026 (full).

Hackernoon

• Varonis notes that ? 80 % of Fortune 500 companies employ AI agents, highlighting the broad exposure potential.

Hackernoon

Exploiting the flaw enables attackers to:

Hackernoon

• Persistently control every Dialogflow CX agent in a project, manipulating responses and impersonating legitimate flows.

Hackernoon

• Exfiltrate personally identifiable information, payment details, and confidential business data without triggering Cloud Logging.

Hackernoon

• Conduct phishing by injecting re-authentication prompts that harvest user credentials.

Hackernoon

• Bypass VPC Service Controls (VPC-SC) through the Cloud Run container’s unrestricted egress, turning it into a covert data-exfiltration proxy.

Hackernoon

• Access the Instance Metadata Service (IMDS) to retrieve low-privilege service-account tokens, creating a pathway for privilege escalation.

Hackernoon

These capabilities threaten regulatory compliance, corporate reputation, and the trust placed in AI-driven customer-service platforms.

Hackernoon

Google acknowledged the issue, issuing an initial security update in April 2026 and confirming full remediation by June 2026. The company, in coordination with Varonis, advised customers to audit Dialogflow CX Playbook configurations, review successful `dialogflow.playbooks.update` events in DATA_WRITE audit logs, and verify that all Code Blocks are whitelisted and approved. Varonis recommended additional monitoring for rare API access, atypical IP addresses, and failed request logs to detect any lingering compromise.

Hackernoon

• “We’ve named this latest discovery Rogue Agent.” — Varonis Threat Labs

Hackernoon

• “The vulnerability allowed attackers to exploit the Code Blocks feature to inject persistent malicious code into the Dialogflow agents’ pipeline, silently exfiltrating conversations and conducting large-scale phishing campaigns.” — Varonis Threat Labs

Hackernoon

• “Cloud Logging did not record the overwrite or the injected logic.” — Varonis Threat Labs

Hackernoon

• “In addition to exfiltrating sensitive data, this channel could also receive commands to enable attackers to create a command-and-control (C2) channel for persistent remote control.” — Varonis Threat Labs

Hackernoon

Organizations are urged to enable DATA_WRITE audit logging for the Dialogflow API, scrutinize past Playbook update events, and manually review all Code Block configurations in the Dialogflow CX console. Incorporating user-entity behavior analytics (UEBA) and continuous posture management can further reduce the risk of similar supply-chain-style attacks on cloud-native AI platforms.

Hackernoon