Google Dialogflow CX security flaw let researchers create rogue agent to hijack AI chatbots

Critical Vulnerability in Google Dialogflow CX Exposed AI Chatbots to Hijacking

Security firm Varonis uncovered a critical security flaw in Google Dialogflow CX, the AI-powered chatbot platform used by companies to build customer service bots, voice assistants, and healthcare chatbots 1

1

. The vulnerability in Google Cloud's Dialogflow CX, named Rogue Agent, could have allowed attackers with limited permissions to hijack Google Dialogflow CX chatbots, read live conversations, steal user data, and compromise other agents across an entire Google Cloud project 2

2

. This Google AI chatbot security flaw particularly threatened organizations handling sensitive customer interactions in financial services, healthcare, and customer support.

How the Rogue Agent Attack Vector Worked

The vulnerability exploited Dialogflow's Code Blocks feature within Playbooks, which allows developers to add custom Python code to chatbot conversation flows 1

1

. All Code Blocks execute within a single Google-managed Cloud Run environment shared across all AI agents in the same Google Cloud project. Varonis discovered that attackers needed only the dialogflow.playbooks.update permission on one agent to inject malicious code that could then compromise other agents 2

2

.

The attack hinged on a writable file called code_execution_env.py that ran every agent's Code Blocks. Because this file sat in the shared environment with write access, a single malicious Code Block could download and overwrite it with attacker-controlled code 1

1

. From that point forward, the modified version executed for every Code Block across every agent sharing that environment, granting access to full conversation history, session state, and the ability to call internal functions like respond().

Data Theft and Phishing Risks for Users

Once the rogue agent was established, attackers could read each conversation and quietly exfiltrate it to external servers, effectively enabling them to steal user data including passwords, insurance information, and financial credentials 3

3

. Matthew Radolec, field CTO at Varonis, told Axios that users could have been tricked into sharing sensitive information through phishing requests, with the bot asking them to re-verify login credentials 3

3

. The attacker could then collect whatever users typed in response.

The Cloud Run environment had unrestricted outbound internet access, allowing attackers to send data directly to external servers using Python's built-in urllib library 1

1

. Varonis noted this bypassed VPC Service Controls, the Google Cloud perimeter designed to prevent data from leaving protected services. The environment also exposed the Instance Metadata Service (IMDS), which handed out tokens for a Google-managed service account, though this account had limited privileges 1

1

.

Detection Challenges and Excessive Privileges

The attack proved virtually undetectable through standard monitoring. The file overwrite occurred inside Google's managed environment where customers have no visibility, and Cloud Logging did not record the file change or injected logic 2

2

. The shared Cloud Run environment featured excessive privileges, a writable filesystem, and public internet egress with no code restrictions 4

4

. Since one compromised agent could control all others within a project, the blast radius extended far beyond the initial entry point.

Google's Response and Timeline

Varonis disclosed the vulnerability through Google's Vulnerability Reward Program in November 2025 1

1

. Google shipped an initial fix in April 2026 and fully resolved the issue in June 2026, approximately seven months from report to resolution 4

4

. A Google Cloud spokesperson stated, "The underlying issue has been fully mitigated, and we have no known indication of customer compromise. No customer action is required" 3

3

. Both Varonis and Google confirmed there is no evidence the flaw was exploited in the wild before patching 1

1

.

What Organizations Should Monitor

For organizations that ran Dialogflow CX agents with Code Block Playbooks before the patch, Varonis recommends conducting post-event analysis by reviewing DATA_WRITE audit logs for the Dialogflow API to identify unexpected playbook updates 4

4

. Teams should correlate these with unusual users, IP addresses, or access times, and run Cloud Logging queries for failed user requests and anomalous Sessions.DetectIntent errors 1

1

. Manually inspecting each agent's Code Blocks for unauthorized code remains essential, as chat logs could contain evidence of data exfiltration attempts.

Broader Implications for AI Security

Radolec argues that AI tools are being adopted faster than technology companies can fully secure them, highlighting how zero trust architecture principles were overlooked in this case 3

3

. As companies increasingly rely on AI chatbots to handle customer service, healthcare, and financial interactions, flaws in these systems become rich targets for credential theft and phishing attacks 3

3

. Security teams deploying AI agents should verify that tools are properly isolated, routinely check for exposed credentials, and ensure that shared environments don't create lateral movement opportunities for attackers.