Rogue Agent Flaw in Google Dialogflow CX Could Let Attackers Hijack AI Chatbots

A critical vulnerability in Google’s Dialogflow CX, dubbed ‘Rogue Agent’ by security firm Varonis, could have allowed an attacker with edit permissions on one Code Block-enabled agent to compromise all other Code Block-enabled agents within the same Google Cloud project. The flaw, discovered by Varonis and disclosed through Google’s Vulnerability Reward Program in November 2025, was fully resolved by Google in June 2026 after an initial fix in April 2026. No CVE was assigned.

The attack required the dialogflow.playbooks.update permission on a single agent, limiting the realistic threat to malicious insiders or compromised developer accounts. From that foothold, the attacker could overwrite a shared file (code_execution_env.py) in the Google-managed Cloud Run environment, which runs all Code Blocks for agents in the same project. By replacing this file with a malicious version, the attacker could read live conversations, exfiltrate user data, and make the chatbot send attacker-written messages, such as phishing requests for passwords.

Varonis also identified two related issues: unrestricted outbound internet access from the Code Block environment, bypassing VPC Service Controls, and exposure of the Instance Metadata Service (IMDS), which leaked a low-privilege service account token. The file overwrite and injected code were not recorded in Cloud Logging, making detection difficult. Google and Varonis confirmed no evidence of real-world exploitation.

Organizations using Dialogflow CX with Code Blocks before the fix should audit dialogflow.playbooks.update permissions, review DATA_WRITE audit logs for unexpected playbook updates, check Cloud Logging for failed user requests, and verify Code Blocks in the Dialogflow console.