Breaking

Google Dialogflow CX Flaw Let One Bot's Editor Reach Others

July 7, 2026 at 12:38 EDT

Security
AI Agents

Varonis Threat Labs has disclosed a vulnerability in Google Cloud's AI conversation platform Dialogflow CX, dubbed "Rogue Agent," that allowed edit permission on a single chatbot to reach other bots in the same project. Google completed a full fix by June 2026.

Google Cloud · Dialogflow CX · Varonis Threat Labs

"Rogue Agent": editing one chatbot could hijack every bot in the project

A flaw in Dialogflow CX "Code Blocks" let an attacker inject persistent Python into a shared Cloud Run environment — enabling lateral movement across all agents in the same GCP project. Patched; no exploitation observed in the wild.

permission needed:
dialogflow.playbooks.update

ALL

agents in the same GCP project reachable from one

80%

of Fortune 500 reported running active AI agents

confirmed real-world exploitations

Disclosure to full fix — 7 months

Reported

Nov 2025

→

Initial patch

Apr 2026

→

Full fix

Jun 2026

How the attack chained

1 · Inject

Abuse Code Blocks to push persistent malicious Python into shared Cloud Run

→

2 · Spread

Lateral movement to every other agent in the same project

→

3 · Harvest & hide

Read history, capture input, alter respond(); overwrite env to evade logging

CONTAINED

Fully patched by June 2026 and no real-world impact reported. Mitigations: audit Playbook update logs and manually review Code Blocks.

STILL A CONCERN

Shared Cloud Run allowed default public outbound traffic and could bypass VPC Service Controls — sitting outside customer visibility and hard to detect.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.